- ice: drop udp_tunnel_get_rx_info() call from ndo_open() (Mohammad Heib) [RHEL-165081] - i40e: drop udp_tunnel_get_rx_info() call from i40e_open() (Mohammad Heib) [RHEL-165081] - ALSA: hda/tas2781: Ignore reset check for SPI device (Jaroslav Kysela) [RHEL-157285] - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158990] - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159227] {CVE-2025-68741} - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Vinay Mulugund) [RHEL-155205] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-158206] - net: openvswitch: Avoid releasing netdev before teardown completes (Toke Høiland-Jørgensen) [RHEL-157946] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155971] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150456] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150456] {CVE-2025-39766} - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157855] - ASoC: soc_sdw_utils: remove index from sdca codec name (Jaroslav Kysela) [RHEL-163717] - ASoC: soc_sdw_utils: partial match the codec name (Jaroslav Kysela) [RHEL-163717] - ASoC: add snd_soc_lookup_component_by_name helper (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Update counting of SU/GE DAPM routes (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Handle CONFIG_PM_SLEEP not being set (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Tidy up some memory allocations (Jaroslav Kysela) [RHEL-163717] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157332] {CVE-2026-23270} - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-168569] {CVE-2026-31402} - KVM: x86/mmu: Only WARN in direct MMUs when overwriting shadow-present SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401} - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401} - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-169354] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-169354] - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166932] {CVE-2025-68724} - net: af_can: do not leave a dangling sk pointer in can_create() (CKI Backport Bot) [RHEL-162253] {CVE-2024-56603} - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171531] - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CKI Backport Bot) [RHEL-170974] {CVE-2026-31408} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172213] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172213] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172213] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172213] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172213] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172213] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172213] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172213] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172213] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172213] - xfrm: esp: avoid in-place decrypt on shared skb frags (CKI Backport Bot) [RHEL-174546] {CVE-2026-43284} - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176449] {CVE-2026-46333} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174029] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171434] {CVE-2026-31607} - Recreate RHEL 6.12.0-211.16.1 from CentOS Stream 10 and upstream stable backports (1106-1161) - Drop 211.7.x security-ahead patches superseded by the RHEL backports (1100-1104: crypto authencesn/algif, xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace) - Keep the smb cifs.spnego ahead-fix (1105) - RHEL changelog for 211.8.1..211.16.1 follows: - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169625] - redhat/kernel.spec.template: disable OBJTOOL_WERROR for gcov builds (Oleksii Baranov) - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174756] {CVE-2026-43303} - dpaa2-switch: validate num_ifs to prevent out-of-bounds write (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205} - dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205} - mm: thp: deny THP for files on anonymous inodes (Rafael Aquini) [RHEL-171617] {CVE-2026-23375} - fs: add S_ANON_INODE (Rafael Aquini) [RHEL-171617] - anon_inode: raise SB_I_NODEV and SB_I_NOEXEC (Rafael Aquini) [RHEL-171617] - pidfs: use anon_inode_setattr() (Rafael Aquini) [RHEL-171617] - anon_inode: explicitly block ->setattr() (Rafael Aquini) [RHEL-171617] - pidfs: use anon_inode_getattr() (Rafael Aquini) [RHEL-171617] - anon_inode: use a proper mode internally (Rafael Aquini) [RHEL-171617] - ice: set max queues in alloc_etherdev_mqs() (CKI Backport Bot) [RHEL-174331] - ice: use netif_get_num_default_rss_queues() (CKI Backport Bot) [RHEL-174331] - net: Fix rcu_tasks stall in threaded busypoll (CKI Backport Bot) [RHEL-170809] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174217] {CVE-2026-43190} - netfilter: ctnetlink: ensure safe access to master conntrack (CKI Backport Bot) [RHEL-173872] {CVE-2026-43116} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173857] {CVE-2026-43110} - redhat/configs: enable CONFIG_AQTION on all archs (CKI Backport Bot) [RHEL-171944] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172745] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172625] {CVE-2026-43027} - io_uring/rsrc: reject zero-length fixed buffer import (CKI Backport Bot) [RHEL-172556] {CVE-2026-43006} - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164434] - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-171637] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-171637] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171159] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171142] {CVE-2026-31684} - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150180] - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-169786] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-169786] - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166991] {CVE-2026-23455} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169738] {CVE-2025-68183} - can: j1939: j1939_session_new(): fix skb reference counting (CKI Backport Bot) [RHEL-162260] {CVE-2024-56645} - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160469] {CVE-2026-23392} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172603] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172577] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-133872] - Recreate RHEL 6.12.0-211.18.1 from CentOS Stream 10 and upstream stable backports (1162-1244) - RHEL changelog for 211.17.1..211.18.1 follows: - Bluetooth: hci_sync: Fix UAF in le_read_features_complete (David Marlin) [RHEL-176903] {CVE-2026-43322} - Bluetooth: hci_sync: fix leaks when hci_cmd_sync_queue_once fails (David Marlin) [RHEL-176903] - Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (David Marlin) [RHEL-176903] - Bluetooth: L2CAP: Add support for setting BT_PHY (David Marlin) [RHEL-176903] - Bluetooth: hci_conn: Fix using conn->le_{tx,rx}_phy as supported PHYs (David Marlin) [RHEL-176903] - Bluetooth: HCI: Add support for LL Extended Feature Set (David Marlin) [RHEL-176903] - Bluetooth: ISO: Add support to bind to trigger PAST (David Marlin) [RHEL-176903] - Bluetooth: HCI: Add initial support for PAST (David Marlin) [RHEL-176903] - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176915] {CVE-2026-43329} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175824] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175824] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175821] - dpll: add pin operational state (Ivan Vecera) [RHEL-175821] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172827] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172827] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172827] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172827] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172827] {CVE-2026-31709} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167837] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167837] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167837] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172930] - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (CKI Backport Bot) [RHEL-171302] - nbd: defer config unlock in nbd_genl_connect (CKI Backport Bot) [RHEL-166953] {CVE-2025-68366} - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163345] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163345] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163345] {CVE-2025-38653} - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178932] {CVE-2026-46243} - redhat/configs: automotive: disable CONFIG_IO_URING (Brian Masney) [RHEL-179469] - sched/deadline: Fix dl_server time accounting (Phil Auld) [RHEL-173950] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171475] {CVE-2026-31613} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157466] - Recreate RHEL 6.12.0-211.20.1 from CentOS Stream 10 and upstream stable backports (1245-1287) - smb cifs.spnego now shipped by RHEL too; existing ahead-fix 1105 is identical (RHEL's redundant copy omitted) - RHEL changelog for 211.19.1..211.20.1 follows: - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473] - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518] - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855] - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419} - scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932] - ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932] - ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932] - ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932] - ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932] - ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932] - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932] - scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932] - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037} - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581} - erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532} - nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788] - Recreate RHEL 6.12.0-211.22.1 from CentOS Stream 10 and upstream stable backports (1288-1352) - RHEL changelog for 211.21.1..211.22.1 follows: - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473] - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518] - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855] - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419} - scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932] - ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932] - ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932] - ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932] - ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932] - ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932] - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932] - scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932] - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037} - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581} - erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532} - nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788] - Recreate RHEL 6.12.0-211.22.1 from CentOS Stream 10 and upstream stable backports (1288-1352) - RHEL changelog for 211.21.1..211.22.1 follows: - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Mircea Dragan) [RHEL-166047] - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183319] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-179723] - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183127] - objtool/klp: Fix unexported static call key access for manually built livepatch modules (Joe Lawrence) [RHEL-178495] - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180307] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180126] {CVE-2026-46125} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180060] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180022] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179358] {CVE-2026-46056} - scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Ewan D. Milne) [RHEL-171774] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175533] {CVE-2026-31474} - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172516] {CVE-2026-31786} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172862] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172492] {CVE-2026-31787} - rxrpc: Fix RxGK token loading to check bounds (CKI Backport Bot) [RHEL-171419] {CVE-2026-31641} - gitlab-ci: use rhel10.2 builder image (Michael Krausch-Hofmann) - redhat/configs: enable watchdog pretimout panic functionality for x86 (David Arcari) [RHEL-182299] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (David Arcari) [RHEL-182299] - mptcp: fix slab-use-after-free in __inet_lookup_established (CKI Backport Bot) [RHEL-171510] {CVE-2026-31669} - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380] {CVE-2026-46331} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173} - crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172772] {CVE-2026-43056} - Recreate RHEL 6.12.0-211.26.1 from CentOS Stream 10 and upstream stable backports (1352-1373) - Enable watchdog pretimeout panic functionality for x86 via kernel config (RHEL-182299) - RHEL changelog for 211.23.1..211.26.1 follows: - nvmet-tcp: fix race between ICReq handling and queue teardown (CKI Backport Bot) [RHEL-180106] {CVE-2026-46135} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180090] {CVE-2026-46145} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172675] {CVE-2026-43038} - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-185117] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174242] {CVE-2026-43198} - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179755] {CVE-2026-43414} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180155] {CVE-2026-46117} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179665] {CVE-2026-45898} - rxrpc: fix RESPONSE authenticator parser OOB read (CKI Backport Bot) [RHEL-171456] {CVE-2026-31636} - Recreate RHEL 6.12.0-211.28.1 from CentOS Stream 10 and upstream stable backports (1375-1383) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1374) - RHEL changelog for 211.27.1..211.28.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759] - crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279} - Recreate RHEL 6.12.0-211.29.1 from CentOS Stream 10 and upstream stable backports (1386-1398) - Retain AlmaLinux ahead-of-RHEL fixes: CVE-2026-46316 (1374), ipv4/ipv6 fraggap (1384-1385) - RHEL changelog for 211.29.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759] - crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279} - Recreate RHEL 6.12.0-211.29.1 from CentOS Stream 10 and upstream stable backports (1386-1398) - Retain AlmaLinux ahead-of-RHEL fixes: CVE-2026-46316 (1374), ipv4/ipv6 fraggap (1384-1385) - RHEL changelog for 211.29.1 follows: - ipv6: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349] - ipv4: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349] - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189491] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182537] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182537] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182537] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182537] - ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions (CKI Backport Bot) [RHEL-185110] - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183965] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181936] {CVE-2026-46244} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179912] {CVE-2026-46209} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998} - rxrpc: Fix potential UAF after skb_unshare() failure (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998} - Recreate RHEL 6.12.0-211.30.1 from CentOS Stream 10 and upstream stable backports (1399-1414) - RHEL 6.12.0-211.30.1 now also carries the vgic-its (CVE-2026-46316) and ipv4/ipv6 fraggap fixes AlmaLinux shipped ahead; the AlmaLinux patches (1374, 1384-1385) are retained and RHEL's duplicate copies omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 211.30.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180776] - eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614} - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180776] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770] - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259} - net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140] - Recreate RHEL 6.12.0-211.31.1 from CentOS Stream 10 and upstream stable backports (1421-1444) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1417) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1418, 1420) - RHEL changelog for 211.31.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Recreate RHEL 6.12.0-211.33.1 from CentOS Stream 10 and upstream stable backports (1451-1455) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1445, 1446) are superseded by RHEL's copies and dropped - RHEL changelog for 211.33.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Recreate RHEL 6.12.0-211.33.1 from CentOS Stream 10 and upstream stable backports (1451-1455) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1445, 1446) are superseded by RHEL's copies and dropped - RHEL changelog for 211.33.1 follows: - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - Recreate RHEL 6.12.0-211.34.1 from CentOS Stream 10 and upstream stable backports (1456-1458) - RHEL changelog for 211.34.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180776] - eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614} - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180776] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770] - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259} - net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140] - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - selftests: kvm: Verify TILELOADD actually #NM faults when XFD[18]=1 (Maxim Levitsky) [RHEL-148618] - selftests: kvm: try getting XFD and XSAVE state out of sync (Maxim Levitsky) [RHEL-148618] - selftests: kvm: replace numbered sync points with actions (Maxim Levitsky) [RHEL-148618] - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Maxim Levitsky) [RHEL-148618] - KVM: selftests: Add ex_str() to print human friendly name of exception vectors (Maxim Levitsky) [RHEL-148618] - KVM: x86: Define AMD's #HV, #VC, and #SX exception vectors (Maxim Levitsky) [RHEL-148618] - KVM: x86: Define Control Protection Exception (#CP) vector (Maxim Levitsky) [RHEL-148618] - KVM: x86: Add human friendly formatting for #XM, and #VE (Maxim Levitsky) [RHEL-148618] - KVM: selftests: Add support for #DE exception fixup (Maxim Levitsky) [RHEL-148618] - idpf: export RX hardware timestamping information to XDP (Michal Schmidt) [RHEL-136674] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - redhat/configs: enable keyboard GPIO for x86 (Mark Langsdorf) [RHEL-147908] - redhat/configs: enable CONFIG_INPUT_SOC_BUTTON_ARRAY on x86 (Mark Langsdorf) [RHEL-135367] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-145800] - selftests/bpf: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - bpf: crypto: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - PCI: vmd: Override irq_startup()/irq_shutdown() in vmd_init_dev_msi_info() (Myron Stowe) [RHEL-143521] - PCI: vmd: Add VMD Device ID Support for Panther Lake (PTL)-H/P/U (Myron Stowe) [RHEL-143521] - net: vlan: don't propagate flags on open (Hangbin Liu) [RHEL-149691] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - redhat/configs: enable keyboard GPIO for x86 (Mark Langsdorf) [RHEL-147908] - redhat/configs: enable CONFIG_INPUT_SOC_BUTTON_ARRAY on x86 (Mark Langsdorf) [RHEL-135367] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-145800] - selftests/bpf: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - bpf: crypto: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - PCI: vmd: Override irq_startup()/irq_shutdown() in vmd_init_dev_msi_info() (Myron Stowe) [RHEL-143521] - PCI: vmd: Add VMD Device ID Support for Panther Lake (PTL)-H/P/U (Myron Stowe) [RHEL-143521] - net: vlan: don't propagate flags on open (Hangbin Liu) [RHEL-149691] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment() and tcp_clone_payload(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - ice: drop udp_tunnel_get_rx_info() call from ndo_open() (Mohammad Heib) [RHEL-165081] - i40e: drop udp_tunnel_get_rx_info() call from i40e_open() (Mohammad Heib) [RHEL-165081] - ALSA: hda/tas2781: Ignore reset check for SPI device (Jaroslav Kysela) [RHEL-157285] - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158990] - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159227] {CVE-2025-68741} - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Vinay Mulugund) [RHEL-155205] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-158206] - net: openvswitch: Avoid releasing netdev before teardown completes (Toke Høiland-Jørgensen) [RHEL-157946] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155971] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150456] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150456] {CVE-2025-39766} - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157855] - ASoC: soc_sdw_utils: remove index from sdca codec name (Jaroslav Kysela) [RHEL-163717] - ASoC: soc_sdw_utils: partial match the codec name (Jaroslav Kysela) [RHEL-163717] - ASoC: add snd_soc_lookup_component_by_name helper (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Update counting of SU/GE DAPM routes (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Handle CONFIG_PM_SLEEP not being set (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Tidy up some memory allocations (Jaroslav Kysela) [RHEL-163717] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157332] {CVE-2026-23270} - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-168569] {CVE-2026-31402} - KVM: x86/mmu: Only WARN in direct MMUs when overwriting shadow-present SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401} - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401} - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-169354] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-169354] - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166932] {CVE-2025-68724} - net: af_can: do not leave a dangling sk pointer in can_create() (CKI Backport Bot) [RHEL-162253] {CVE-2024-56603} - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171531] - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CKI Backport Bot) [RHEL-170974] {CVE-2026-31408} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172213] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172213] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172213] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172213] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172213] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172213] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172213] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172213] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172213] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172213] - xfrm: esp: avoid in-place decrypt on shared skb frags (CKI Backport Bot) [RHEL-174546] {CVE-2026-43284} - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176449] {CVE-2026-46333} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174029] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171434] {CVE-2026-31607} - Recreate RHEL 6.12.0-211.16.1 from CentOS Stream 10 and upstream stable backports (1106-1161) - Drop 211.7.x security-ahead patches superseded by the RHEL backports (1100-1104: crypto authencesn/algif, xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace) - Keep the smb cifs.spnego ahead-fix (1105) - RHEL changelog for 211.8.1..211.16.1 follows: - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169625] - redhat/kernel.spec.template: disable OBJTOOL_WERROR for gcov builds (Oleksii Baranov) - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174756] {CVE-2026-43303} - dpaa2-switch: validate num_ifs to prevent out-of-bounds write (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205} - dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205} - mm: thp: deny THP for files on anonymous inodes (Rafael Aquini) [RHEL-171617] {CVE-2026-23375} - fs: add S_ANON_INODE (Rafael Aquini) [RHEL-171617] - anon_inode: raise SB_I_NODEV and SB_I_NOEXEC (Rafael Aquini) [RHEL-171617] - pidfs: use anon_inode_setattr() (Rafael Aquini) [RHEL-171617] - anon_inode: explicitly block ->setattr() (Rafael Aquini) [RHEL-171617] - pidfs: use anon_inode_getattr() (Rafael Aquini) [RHEL-171617] - anon_inode: use a proper mode internally (Rafael Aquini) [RHEL-171617] - ice: set max queues in alloc_etherdev_mqs() (CKI Backport Bot) [RHEL-174331] - ice: use netif_get_num_default_rss_queues() (CKI Backport Bot) [RHEL-174331] - net: Fix rcu_tasks stall in threaded busypoll (CKI Backport Bot) [RHEL-170809] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174217] {CVE-2026-43190} - netfilter: ctnetlink: ensure safe access to master conntrack (CKI Backport Bot) [RHEL-173872] {CVE-2026-43116} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173857] {CVE-2026-43110} - redhat/configs: enable CONFIG_AQTION on all archs (CKI Backport Bot) [RHEL-171944] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172745] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172625] {CVE-2026-43027} - io_uring/rsrc: reject zero-length fixed buffer import (CKI Backport Bot) [RHEL-172556] {CVE-2026-43006} - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164434] - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-171637] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-171637] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171159] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171142] {CVE-2026-31684} - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150180] - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-169786] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-169786] - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166991] {CVE-2026-23455} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169738] {CVE-2025-68183} - can: j1939: j1939_session_new(): fix skb reference counting (CKI Backport Bot) [RHEL-162260] {CVE-2024-56645} - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160469] {CVE-2026-23392} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172603] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172577] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-133872] - Recreate RHEL 6.12.0-211.18.1 from CentOS Stream 10 and upstream stable backports (1162-1244) - RHEL changelog for 211.17.1..211.18.1 follows: - Bluetooth: hci_sync: Fix UAF in le_read_features_complete (David Marlin) [RHEL-176903] {CVE-2026-43322} - Bluetooth: hci_sync: fix leaks when hci_cmd_sync_queue_once fails (David Marlin) [RHEL-176903] - Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (David Marlin) [RHEL-176903] - Bluetooth: L2CAP: Add support for setting BT_PHY (David Marlin) [RHEL-176903] - Bluetooth: hci_conn: Fix using conn->le_{tx,rx}_phy as supported PHYs (David Marlin) [RHEL-176903] - Bluetooth: HCI: Add support for LL Extended Feature Set (David Marlin) [RHEL-176903] - Bluetooth: ISO: Add support to bind to trigger PAST (David Marlin) [RHEL-176903] - Bluetooth: HCI: Add initial support for PAST (David Marlin) [RHEL-176903] - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176915] {CVE-2026-43329} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175824] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175824] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175821] - dpll: add pin operational state (Ivan Vecera) [RHEL-175821] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172827] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172827] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172827] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172827] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172827] {CVE-2026-31709} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167837] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167837] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167837] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172930] - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (CKI Backport Bot) [RHEL-171302] - nbd: defer config unlock in nbd_genl_connect (CKI Backport Bot) [RHEL-166953] {CVE-2025-68366} - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163345] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163345] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163345] {CVE-2025-38653} - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178932] {CVE-2026-46243} - redhat/configs: automotive: disable CONFIG_IO_URING (Brian Masney) [RHEL-179469] - sched/deadline: Fix dl_server time accounting (Phil Auld) [RHEL-173950] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171475] {CVE-2026-31613} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157466] - Recreate RHEL 6.12.0-211.20.1 from CentOS Stream 10 and upstream stable backports (1245-1287) - smb cifs.spnego now shipped by RHEL too; existing ahead-fix 1105 is identical (RHEL's redundant copy omitted) - RHEL changelog for 211.19.1..211.20.1 follows: - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473] - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518] - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855] - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419} - scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932] - ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932] - ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932] - ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932] - ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932] - ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932] - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932] - scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932] - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037} - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581} - erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532} - nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788] - Recreate RHEL 6.12.0-211.22.1 from CentOS Stream 10 and upstream stable backports (1288-1352) - RHEL changelog for 211.21.1..211.22.1 follows: - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473] - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518] - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855] - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419} - scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932] - ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932] - ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932] - ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932] - ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932] - ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932] - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932] - scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932] - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037} - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581} - erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532} - nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788] - Recreate RHEL 6.12.0-211.22.1 from CentOS Stream 10 and upstream stable backports (1288-1352) - RHEL changelog for 211.21.1..211.22.1 follows: - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Mircea Dragan) [RHEL-166047] - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183319] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-179723] - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183127] - objtool/klp: Fix unexported static call key access for manually built livepatch modules (Joe Lawrence) [RHEL-178495] - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180307] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180126] {CVE-2026-46125} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180060] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180022] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179358] {CVE-2026-46056} - scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Ewan D. Milne) [RHEL-171774] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175533] {CVE-2026-31474} - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172516] {CVE-2026-31786} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172862] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172492] {CVE-2026-31787} - rxrpc: Fix RxGK token loading to check bounds (CKI Backport Bot) [RHEL-171419] {CVE-2026-31641} - gitlab-ci: use rhel10.2 builder image (Michael Krausch-Hofmann) - redhat/configs: enable watchdog pretimout panic functionality for x86 (David Arcari) [RHEL-182299] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (David Arcari) [RHEL-182299] - mptcp: fix slab-use-after-free in __inet_lookup_established (CKI Backport Bot) [RHEL-171510] {CVE-2026-31669} - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380] {CVE-2026-46331} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173} - crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172772] {CVE-2026-43056} - Recreate RHEL 6.12.0-211.26.1 from CentOS Stream 10 and upstream stable backports (1352-1373) - Enable watchdog pretimeout panic functionality for x86 via kernel config (RHEL-182299) - RHEL changelog for 211.23.1..211.26.1 follows: - nvmet-tcp: fix race between ICReq handling and queue teardown (CKI Backport Bot) [RHEL-180106] {CVE-2026-46135} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180090] {CVE-2026-46145} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172675] {CVE-2026-43038} - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-185117] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174242] {CVE-2026-43198} - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179755] {CVE-2026-43414} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180155] {CVE-2026-46117} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179665] {CVE-2026-45898} - rxrpc: fix RESPONSE authenticator parser OOB read (CKI Backport Bot) [RHEL-171456] {CVE-2026-31636} - Recreate RHEL 6.12.0-211.28.1 from CentOS Stream 10 and upstream stable backports (1375-1383) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1374) - RHEL changelog for 211.27.1..211.28.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759] - crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279} - Recreate RHEL 6.12.0-211.29.1 from CentOS Stream 10 and upstream stable backports (1386-1398) - Retain AlmaLinux ahead-of-RHEL fixes: CVE-2026-46316 (1374), ipv4/ipv6 fraggap (1384-1385) - RHEL changelog for 211.29.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759] - crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279} - Recreate RHEL 6.12.0-211.29.1 from CentOS Stream 10 and upstream stable backports (1386-1398) - Retain AlmaLinux ahead-of-RHEL fixes: CVE-2026-46316 (1374), ipv4/ipv6 fraggap (1384-1385) - RHEL changelog for 211.29.1 follows: - ipv6: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349] - ipv4: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349] - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189491] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182537] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182537] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182537] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182537] - ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions (CKI Backport Bot) [RHEL-185110] - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183965] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181936] {CVE-2026-46244} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179912] {CVE-2026-46209} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998} - rxrpc: Fix potential UAF after skb_unshare() failure (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998} - Recreate RHEL 6.12.0-211.30.1 from CentOS Stream 10 and upstream stable backports (1399-1414) - RHEL 6.12.0-211.30.1 now also carries the vgic-its (CVE-2026-46316) and ipv4/ipv6 fraggap fixes AlmaLinux shipped ahead; the AlmaLinux patches (1374, 1384-1385) are retained and RHEL's duplicate copies omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 211.30.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180776] - eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614} - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180776] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770] - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259} - net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140] - Recreate RHEL 6.12.0-211.31.1 from CentOS Stream 10 and upstream stable backports (1421-1444) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1417) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1418, 1420) - RHEL changelog for 211.31.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Recreate RHEL 6.12.0-211.33.1 from CentOS Stream 10 and upstream stable backports (1451-1455) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1445, 1446) are superseded by RHEL's copies and dropped - RHEL changelog for 211.33.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Recreate RHEL 6.12.0-211.33.1 from CentOS Stream 10 and upstream stable backports (1451-1455) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1445, 1446) are superseded by RHEL's copies and dropped - RHEL changelog for 211.33.1 follows: - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - Recreate RHEL 6.12.0-211.34.1 from CentOS Stream 10 and upstream stable backports (1456-1458) - RHEL changelog for 211.34.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180776] - eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614} - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180776] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770] - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259} - net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140] - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - selftests: kvm: Verify TILELOADD actually #NM faults when XFD[18]=1 (Maxim Levitsky) [RHEL-148618] - selftests: kvm: try getting XFD and XSAVE state out of sync (Maxim Levitsky) [RHEL-148618] - selftests: kvm: replace numbered sync points with actions (Maxim Levitsky) [RHEL-148618] - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Maxim Levitsky) [RHEL-148618] - KVM: selftests: Add ex_str() to print human friendly name of exception vectors (Maxim Levitsky) [RHEL-148618] - KVM: x86: Define AMD's #HV, #VC, and #SX exception vectors (Maxim Levitsky) [RHEL-148618] - KVM: x86: Define Control Protection Exception (#CP) vector (Maxim Levitsky) [RHEL-148618] - KVM: x86: Add human friendly formatting for #XM, and #VE (Maxim Levitsky) [RHEL-148618] - KVM: selftests: Add support for #DE exception fixup (Maxim Levitsky) [RHEL-148618] - idpf: export RX hardware timestamping information to XDP (Michal Schmidt) [RHEL-136674] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - redhat/configs: enable keyboard GPIO for x86 (Mark Langsdorf) [RHEL-147908] - redhat/configs: enable CONFIG_INPUT_SOC_BUTTON_ARRAY on x86 (Mark Langsdorf) [RHEL-135367] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-145800] - selftests/bpf: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - bpf: crypto: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - PCI: vmd: Override irq_startup()/irq_shutdown() in vmd_init_dev_msi_info() (Myron Stowe) [RHEL-143521] - PCI: vmd: Add VMD Device ID Support for Panther Lake (PTL)-H/P/U (Myron Stowe) [RHEL-143521] - net: vlan: don't propagate flags on open (Hangbin Liu) [RHEL-149691] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - redhat/configs: enable keyboard GPIO for x86 (Mark Langsdorf) [RHEL-147908] - redhat/configs: enable CONFIG_INPUT_SOC_BUTTON_ARRAY on x86 (Mark Langsdorf) [RHEL-135367] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-145800] - selftests/bpf: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - bpf: crypto: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - PCI: vmd: Override irq_startup()/irq_shutdown() in vmd_init_dev_msi_info() (Myron Stowe) [RHEL-143521] - PCI: vmd: Add VMD Device ID Support for Panther Lake (PTL)-H/P/U (Myron Stowe) [RHEL-143521] - net: vlan: don't propagate flags on open (Hangbin Liu) [RHEL-149691] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment() and tcp_clone_payload(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - ice: drop udp_tunnel_get_rx_info() call from ndo_open() (Mohammad Heib) [RHEL-165081] - i40e: drop udp_tunnel_get_rx_info() call from i40e_open() (Mohammad Heib) [RHEL-165081] - ALSA: hda/tas2781: Ignore reset check for SPI device (Jaroslav Kysela) [RHEL-157285] - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158990] - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159227] {CVE-2025-68741} - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Vinay Mulugund) [RHEL-155205] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-158206] - net: openvswitch: Avoid releasing netdev before teardown completes (Toke Høiland-Jørgensen) [RHEL-157946] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155971] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150456] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150456] {CVE-2025-39766} - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157855] - ASoC: soc_sdw_utils: remove index from sdca codec name (Jaroslav Kysela) [RHEL-163717] - ASoC: soc_sdw_utils: partial match the codec name (Jaroslav Kysela) [RHEL-163717] - ASoC: add snd_soc_lookup_component_by_name helper (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Update counting of SU/GE DAPM routes (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Handle CONFIG_PM_SLEEP not being set (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Tidy up some memory allocations (Jaroslav Kysela) [RHEL-163717] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157332] {CVE-2026-23270} - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-168569] {CVE-2026-31402} - KVM: x86/mmu: Only WARN in direct MMUs when overwriting shadow-present SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401} - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401} - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-169354] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-169354] - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166932] {CVE-2025-68724} - net: af_can: do not leave a dangling sk pointer in can_create() (CKI Backport Bot) [RHEL-162253] {CVE-2024-56603} - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171531] - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CKI Backport Bot) [RHEL-170974] {CVE-2026-31408} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172213] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172213] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172213] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172213] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172213] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172213] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172213] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172213] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172213] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172213] - xfrm: esp: avoid in-place decrypt on shared skb frags (CKI Backport Bot) [RHEL-174546] {CVE-2026-43284} - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176449] {CVE-2026-46333} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174029] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171434] {CVE-2026-31607} - Recreate RHEL 6.12.0-211.16.1 from CentOS Stream 10 and upstream stable backports (1106-1161) - Drop 211.7.x security-ahead patches superseded by the RHEL backports (1100-1104: crypto authencesn/algif, xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace) - Keep the smb cifs.spnego ahead-fix (1105) - RHEL changelog for 211.8.1..211.16.1 follows: - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169625] - redhat/kernel.spec.template: disable OBJTOOL_WERROR for gcov builds (Oleksii Baranov) - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174756] {CVE-2026-43303} - dpaa2-switch: validate num_ifs to prevent out-of-bounds write (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205} - dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205} - mm: thp: deny THP for files on anonymous inodes (Rafael Aquini) [RHEL-171617] {CVE-2026-23375} - fs: add S_ANON_INODE (Rafael Aquini) [RHEL-171617] - anon_inode: raise SB_I_NODEV and SB_I_NOEXEC (Rafael Aquini) [RHEL-171617] - pidfs: use anon_inode_setattr() (Rafael Aquini) [RHEL-171617] - anon_inode: explicitly block ->setattr() (Rafael Aquini) [RHEL-171617] - pidfs: use anon_inode_getattr() (Rafael Aquini) [RHEL-171617] - anon_inode: use a proper mode internally (Rafael Aquini) [RHEL-171617] - ice: set max queues in alloc_etherdev_mqs() (CKI Backport Bot) [RHEL-174331] - ice: use netif_get_num_default_rss_queues() (CKI Backport Bot) [RHEL-174331] - net: Fix rcu_tasks stall in threaded busypoll (CKI Backport Bot) [RHEL-170809] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174217] {CVE-2026-43190} - netfilter: ctnetlink: ensure safe access to master conntrack (CKI Backport Bot) [RHEL-173872] {CVE-2026-43116} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173857] {CVE-2026-43110} - redhat/configs: enable CONFIG_AQTION on all archs (CKI Backport Bot) [RHEL-171944] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172745] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172625] {CVE-2026-43027} - io_uring/rsrc: reject zero-length fixed buffer import (CKI Backport Bot) [RHEL-172556] {CVE-2026-43006} - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164434] - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-171637] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-171637] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171159] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171142] {CVE-2026-31684} - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150180] - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-169786] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-169786] - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166991] {CVE-2026-23455} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169738] {CVE-2025-68183} - can: j1939: j1939_session_new(): fix skb reference counting (CKI Backport Bot) [RHEL-162260] {CVE-2024-56645} - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160469] {CVE-2026-23392} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172603] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172577] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-133872] - Recreate RHEL 6.12.0-211.18.1 from CentOS Stream 10 and upstream stable backports (1162-1244) - RHEL changelog for 211.17.1..211.18.1 follows: - Bluetooth: hci_sync: Fix UAF in le_read_features_complete (David Marlin) [RHEL-176903] {CVE-2026-43322} - Bluetooth: hci_sync: fix leaks when hci_cmd_sync_queue_once fails (David Marlin) [RHEL-176903] - Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (David Marlin) [RHEL-176903] - Bluetooth: L2CAP: Add support for setting BT_PHY (David Marlin) [RHEL-176903] - Bluetooth: hci_conn: Fix using conn->le_{tx,rx}_phy as supported PHYs (David Marlin) [RHEL-176903] - Bluetooth: HCI: Add support for LL Extended Feature Set (David Marlin) [RHEL-176903] - Bluetooth: ISO: Add support to bind to trigger PAST (David Marlin) [RHEL-176903] - Bluetooth: HCI: Add initial support for PAST (David Marlin) [RHEL-176903] - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176915] {CVE-2026-43329} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175824] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175824] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175821] - dpll: add pin operational state (Ivan Vecera) [RHEL-175821] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172827] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172827] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172827] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172827] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172827] {CVE-2026-31709} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167837] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167837] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167837] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172930] - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (CKI Backport Bot) [RHEL-171302] - nbd: defer config unlock in nbd_genl_connect (CKI Backport Bot) [RHEL-166953] {CVE-2025-68366} - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163345] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163345] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163345] {CVE-2025-38653} - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178932] {CVE-2026-46243} - redhat/configs: automotive: disable CONFIG_IO_URING (Brian Masney) [RHEL-179469] - sched/deadline: Fix dl_server time accounting (Phil Auld) [RHEL-173950] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171475] {CVE-2026-31613} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157466] - Recreate RHEL 6.12.0-211.20.1 from CentOS Stream 10 and upstream stable backports (1245-1287) - smb cifs.spnego now shipped by RHEL too; existing ahead-fix 1105 is identical (RHEL's redundant copy omitted) - RHEL changelog for 211.19.1..211.20.1 follows: - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473] - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518] - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855] - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419} - scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932] - ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932] - ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932] - ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932] - ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932] - ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932] - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932] - scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932] - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037} - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581} - erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532} - nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788] - Recreate RHEL 6.12.0-211.22.1 from CentOS Stream 10 and upstream stable backports (1288-1352) - RHEL changelog for 211.21.1..211.22.1 follows: - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473] - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518] - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855] - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419} - scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932] - ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932] - ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932] - ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932] - ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932] - ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932] - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932] - scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932] - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037} - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581} - erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532} - nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788] - Recreate RHEL 6.12.0-211.22.1 from CentOS Stream 10 and upstream stable backports (1288-1352) - RHEL changelog for 211.21.1..211.22.1 follows: - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Mircea Dragan) [RHEL-166047] - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183319] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-179723] - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183127] - objtool/klp: Fix unexported static call key access for manually built livepatch modules (Joe Lawrence) [RHEL-178495] - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180307] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180126] {CVE-2026-46125} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180060] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180022] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179358] {CVE-2026-46056} - scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Ewan D. Milne) [RHEL-171774] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175533] {CVE-2026-31474} - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172516] {CVE-2026-31786} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172862] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172492] {CVE-2026-31787} - rxrpc: Fix RxGK token loading to check bounds (CKI Backport Bot) [RHEL-171419] {CVE-2026-31641} - gitlab-ci: use rhel10.2 builder image (Michael Krausch-Hofmann) - redhat/configs: enable watchdog pretimout panic functionality for x86 (David Arcari) [RHEL-182299] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (David Arcari) [RHEL-182299] - mptcp: fix slab-use-after-free in __inet_lookup_established (CKI Backport Bot) [RHEL-171510] {CVE-2026-31669} - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380] {CVE-2026-46331} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173} - crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172772] {CVE-2026-43056} - Recreate RHEL 6.12.0-211.26.1 from CentOS Stream 10 and upstream stable backports (1352-1373) - Enable watchdog pretimeout panic functionality for x86 via kernel config (RHEL-182299) - RHEL changelog for 211.23.1..211.26.1 follows: - nvmet-tcp: fix race between ICReq handling and queue teardown (CKI Backport Bot) [RHEL-180106] {CVE-2026-46135} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180090] {CVE-2026-46145} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172675] {CVE-2026-43038} - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-185117] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174242] {CVE-2026-43198} - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179755] {CVE-2026-43414} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180155] {CVE-2026-46117} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179665] {CVE-2026-45898} - rxrpc: fix RESPONSE authenticator parser OOB read (CKI Backport Bot) [RHEL-171456] {CVE-2026-31636} - Recreate RHEL 6.12.0-211.28.1 from CentOS Stream 10 and upstream stable backports (1375-1383) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1374) - RHEL changelog for 211.27.1..211.28.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759] - crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279} - Recreate RHEL 6.12.0-211.29.1 from CentOS Stream 10 and upstream stable backports (1386-1398) - Retain AlmaLinux ahead-of-RHEL fixes: CVE-2026-46316 (1374), ipv4/ipv6 fraggap (1384-1385) - RHEL changelog for 211.29.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759] - crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279} - Recreate RHEL 6.12.0-211.29.1 from CentOS Stream 10 and upstream stable backports (1386-1398) - Retain AlmaLinux ahead-of-RHEL fixes: CVE-2026-46316 (1374), ipv4/ipv6 fraggap (1384-1385) - RHEL changelog for 211.29.1 follows: - ipv6: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349] - ipv4: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349] - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189491] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182537] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182537] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182537] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182537] - ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions (CKI Backport Bot) [RHEL-185110] - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183965] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181936] {CVE-2026-46244} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179912] {CVE-2026-46209} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998} - rxrpc: Fix potential UAF after skb_unshare() failure (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998} - Recreate RHEL 6.12.0-211.30.1 from CentOS Stream 10 and upstream stable backports (1399-1414) - RHEL 6.12.0-211.30.1 now also carries the vgic-its (CVE-2026-46316) and ipv4/ipv6 fraggap fixes AlmaLinux shipped ahead; the AlmaLinux patches (1374, 1384-1385) are retained and RHEL's duplicate copies omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 211.30.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180776] - eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614} - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180776] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770] - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259} - net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140] - Recreate RHEL 6.12.0-211.31.1 from CentOS Stream 10 and upstream stable backports (1421-1444) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1417) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1418, 1420) - RHEL changelog for 211.31.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Recreate RHEL 6.12.0-211.33.1 from CentOS Stream 10 and upstream stable backports (1451-1455) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1445, 1446) are superseded by RHEL's copies and dropped - RHEL changelog for 211.33.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Recreate RHEL 6.12.0-211.33.1 from CentOS Stream 10 and upstream stable backports (1451-1455) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1445, 1446) are superseded by RHEL's copies and dropped - RHEL changelog for 211.33.1 follows: - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - Recreate RHEL 6.12.0-211.34.1 from CentOS Stream 10 and upstream stable backports (1456-1458) - RHEL changelog for 211.34.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180776] - eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614} - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180776] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770] - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259} - net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140] - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - selftests: kvm: Verify TILELOADD actually #NM faults when XFD[18]=1 (Maxim Levitsky) [RHEL-148618] - selftests: kvm: try getting XFD and XSAVE state out of sync (Maxim Levitsky) [RHEL-148618] - selftests: kvm: replace numbered sync points with actions (Maxim Levitsky) [RHEL-148618] - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Maxim Levitsky) [RHEL-148618] - KVM: selftests: Add ex_str() to print human friendly name of exception vectors (Maxim Levitsky) [RHEL-148618] - KVM: x86: Define AMD's #HV, #VC, and #SX exception vectors (Maxim Levitsky) [RHEL-148618] - KVM: x86: Define Control Protection Exception (#CP) vector (Maxim Levitsky) [RHEL-148618] - KVM: x86: Add human friendly formatting for #XM, and #VE (Maxim Levitsky) [RHEL-148618] - KVM: selftests: Add support for #DE exception fixup (Maxim Levitsky) [RHEL-148618] - idpf: export RX hardware timestamping information to XDP (Michal Schmidt) [RHEL-136674] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - redhat/configs: enable keyboard GPIO for x86 (Mark Langsdorf) [RHEL-147908] - redhat/configs: enable CONFIG_INPUT_SOC_BUTTON_ARRAY on x86 (Mark Langsdorf) [RHEL-135367] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-145800] - selftests/bpf: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - bpf: crypto: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - PCI: vmd: Override irq_startup()/irq_shutdown() in vmd_init_dev_msi_info() (Myron Stowe) [RHEL-143521] - PCI: vmd: Add VMD Device ID Support for Panther Lake (PTL)-H/P/U (Myron Stowe) [RHEL-143521] - net: vlan: don't propagate flags on open (Hangbin Liu) [RHEL-149691] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - redhat/configs: enable keyboard GPIO for x86 (Mark Langsdorf) [RHEL-147908] - redhat/configs: enable CONFIG_INPUT_SOC_BUTTON_ARRAY on x86 (Mark Langsdorf) [RHEL-135367] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-145800] - selftests/bpf: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - bpf: crypto: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - PCI: vmd: Override irq_startup()/irq_shutdown() in vmd_init_dev_msi_info() (Myron Stowe) [RHEL-143521] - PCI: vmd: Add VMD Device ID Support for Panther Lake (PTL)-H/P/U (Myron Stowe) [RHEL-143521] - net: vlan: don't propagate flags on open (Hangbin Liu) [RHEL-149691] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment() and tcp_clone_payload(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - ice: drop udp_tunnel_get_rx_info() call from ndo_open() (Mohammad Heib) [RHEL-165081] - i40e: drop udp_tunnel_get_rx_info() call from i40e_open() (Mohammad Heib) [RHEL-165081] - ALSA: hda/tas2781: Ignore reset check for SPI device (Jaroslav Kysela) [RHEL-157285] - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158990] - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159227] {CVE-2025-68741} - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Vinay Mulugund) [RHEL-155205] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-158206] - net: openvswitch: Avoid releasing netdev before teardown completes (Toke Høiland-Jørgensen) [RHEL-157946] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155971] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150456] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150456] {CVE-2025-39766} - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157855] - ASoC: soc_sdw_utils: remove index from sdca codec name (Jaroslav Kysela) [RHEL-163717] - ASoC: soc_sdw_utils: partial match the codec name (Jaroslav Kysela) [RHEL-163717] - ASoC: add snd_soc_lookup_component_by_name helper (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Update counting of SU/GE DAPM routes (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Handle CONFIG_PM_SLEEP not being set (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Tidy up some memory allocations (Jaroslav Kysela) [RHEL-163717] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157332] {CVE-2026-23270} - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-168569] {CVE-2026-31402} - KVM: x86/mmu: Only WARN in direct MMUs when overwriting shadow-present SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401} - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401} - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-169354] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-169354] - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166932] {CVE-2025-68724} - net: af_can: do not leave a dangling sk pointer in can_create() (CKI Backport Bot) [RHEL-162253] {CVE-2024-56603} - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171531] - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CKI Backport Bot) [RHEL-170974] {CVE-2026-31408} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172213] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172213] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172213] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172213] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172213] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172213] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172213] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172213] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172213] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172213] - xfrm: esp: avoid in-place decrypt on shared skb frags (CKI Backport Bot) [RHEL-174546] {CVE-2026-43284} - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176449] {CVE-2026-46333} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174029] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171434] {CVE-2026-31607} - Recreate RHEL 6.12.0-211.16.1 from CentOS Stream 10 and upstream stable backports (1106-1161) - Drop 211.7.x security-ahead patches superseded by the RHEL backports (1100-1104: crypto authencesn/algif, xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace) - Keep the smb cifs.spnego ahead-fix (1105) - RHEL changelog for 211.8.1..211.16.1 follows: - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169625] - redhat/kernel.spec.template: disable OBJTOOL_WERROR for gcov builds (Oleksii Baranov) - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174756] {CVE-2026-43303} - dpaa2-switch: validate num_ifs to prevent out-of-bounds write (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205} - dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205} - mm: thp: deny THP for files on anonymous inodes (Rafael Aquini) [RHEL-171617] {CVE-2026-23375} - fs: add S_ANON_INODE (Rafael Aquini) [RHEL-171617] - anon_inode: raise SB_I_NODEV and SB_I_NOEXEC (Rafael Aquini) [RHEL-171617] - pidfs: use anon_inode_setattr() (Rafael Aquini) [RHEL-171617] - anon_inode: explicitly block ->setattr() (Rafael Aquini) [RHEL-171617] - pidfs: use anon_inode_getattr() (Rafael Aquini) [RHEL-171617] - anon_inode: use a proper mode internally (Rafael Aquini) [RHEL-171617] - ice: set max queues in alloc_etherdev_mqs() (CKI Backport Bot) [RHEL-174331] - ice: use netif_get_num_default_rss_queues() (CKI Backport Bot) [RHEL-174331] - net: Fix rcu_tasks stall in threaded busypoll (CKI Backport Bot) [RHEL-170809] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174217] {CVE-2026-43190} - netfilter: ctnetlink: ensure safe access to master conntrack (CKI Backport Bot) [RHEL-173872] {CVE-2026-43116} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173857] {CVE-2026-43110} - redhat/configs: enable CONFIG_AQTION on all archs (CKI Backport Bot) [RHEL-171944] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172745] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172625] {CVE-2026-43027} - io_uring/rsrc: reject zero-length fixed buffer import (CKI Backport Bot) [RHEL-172556] {CVE-2026-43006} - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164434] - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-171637] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-171637] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171159] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171142] {CVE-2026-31684} - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150180] - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-169786] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-169786] - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166991] {CVE-2026-23455} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169738] {CVE-2025-68183} - can: j1939: j1939_session_new(): fix skb reference counting (CKI Backport Bot) [RHEL-162260] {CVE-2024-56645} - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160469] {CVE-2026-23392} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172603] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172577] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-133872] - Recreate RHEL 6.12.0-211.18.1 from CentOS Stream 10 and upstream stable backports (1162-1244) - RHEL changelog for 211.17.1..211.18.1 follows: - Bluetooth: hci_sync: Fix UAF in le_read_features_complete (David Marlin) [RHEL-176903] {CVE-2026-43322} - Bluetooth: hci_sync: fix leaks when hci_cmd_sync_queue_once fails (David Marlin) [RHEL-176903] - Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (David Marlin) [RHEL-176903] - Bluetooth: L2CAP: Add support for setting BT_PHY (David Marlin) [RHEL-176903] - Bluetooth: hci_conn: Fix using conn->le_{tx,rx}_phy as supported PHYs (David Marlin) [RHEL-176903] - Bluetooth: HCI: Add support for LL Extended Feature Set (David Marlin) [RHEL-176903] - Bluetooth: ISO: Add support to bind to trigger PAST (David Marlin) [RHEL-176903] - Bluetooth: HCI: Add initial support for PAST (David Marlin) [RHEL-176903] - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176915] {CVE-2026-43329} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175824] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175824] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175821] - dpll: add pin operational state (Ivan Vecera) [RHEL-175821] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172827] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172827] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172827] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172827] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172827] {CVE-2026-31709} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167837] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167837] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167837] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172930] - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (CKI Backport Bot) [RHEL-171302] - nbd: defer config unlock in nbd_genl_connect (CKI Backport Bot) [RHEL-166953] {CVE-2025-68366} - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163345] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163345] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163345] {CVE-2025-38653} - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178932] {CVE-2026-46243} - redhat/configs: automotive: disable CONFIG_IO_URING (Brian Masney) [RHEL-179469] - sched/deadline: Fix dl_server time accounting (Phil Auld) [RHEL-173950] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171475] {CVE-2026-31613} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157466] - Recreate RHEL 6.12.0-211.20.1 from CentOS Stream 10 and upstream stable backports (1245-1287) - smb cifs.spnego now shipped by RHEL too; existing ahead-fix 1105 is identical (RHEL's redundant copy omitted) - RHEL changelog for 211.19.1..211.20.1 follows: - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473] - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518] - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855] - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419} - scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932] - ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932] - ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932] - ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932] - ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932] - ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932] - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932] - scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932] - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037} - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581} - erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532} - nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788] - Recreate RHEL 6.12.0-211.22.1 from CentOS Stream 10 and upstream stable backports (1288-1352) - RHEL changelog for 211.21.1..211.22.1 follows: - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473] - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518] - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855] - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419} - scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932] - ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932] - ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932] - ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932] - ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932] - ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932] - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932] - scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932] - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037} - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581} - erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532} - nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788] - Recreate RHEL 6.12.0-211.22.1 from CentOS Stream 10 and upstream stable backports (1288-1352) - RHEL changelog for 211.21.1..211.22.1 follows: - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Mircea Dragan) [RHEL-166047] - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183319] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-179723] - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183127] - objtool/klp: Fix unexported static call key access for manually built livepatch modules (Joe Lawrence) [RHEL-178495] - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180307] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180126] {CVE-2026-46125} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180060] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180022] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179358] {CVE-2026-46056} - scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Ewan D. Milne) [RHEL-171774] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175533] {CVE-2026-31474} - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172516] {CVE-2026-31786} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172862] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172492] {CVE-2026-31787} - rxrpc: Fix RxGK token loading to check bounds (CKI Backport Bot) [RHEL-171419] {CVE-2026-31641} - gitlab-ci: use rhel10.2 builder image (Michael Krausch-Hofmann) - redhat/configs: enable watchdog pretimout panic functionality for x86 (David Arcari) [RHEL-182299] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (David Arcari) [RHEL-182299] - mptcp: fix slab-use-after-free in __inet_lookup_established (CKI Backport Bot) [RHEL-171510] {CVE-2026-31669} - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380] {CVE-2026-46331} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173} - crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172772] {CVE-2026-43056} - Recreate RHEL 6.12.0-211.26.1 from CentOS Stream 10 and upstream stable backports (1352-1373) - Enable watchdog pretimeout panic functionality for x86 via kernel config (RHEL-182299) - RHEL changelog for 211.23.1..211.26.1 follows: - nvmet-tcp: fix race between ICReq handling and queue teardown (CKI Backport Bot) [RHEL-180106] {CVE-2026-46135} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180090] {CVE-2026-46145} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172675] {CVE-2026-43038} - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-185117] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174242] {CVE-2026-43198} - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179755] {CVE-2026-43414} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180155] {CVE-2026-46117} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179665] {CVE-2026-45898} - rxrpc: fix RESPONSE authenticator parser OOB read (CKI Backport Bot) [RHEL-171456] {CVE-2026-31636} - Recreate RHEL 6.12.0-211.28.1 from CentOS Stream 10 and upstream stable backports (1375-1383) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1374) - RHEL changelog for 211.27.1..211.28.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759] - crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279} - Recreate RHEL 6.12.0-211.29.1 from CentOS Stream 10 and upstream stable backports (1386-1398) - Retain AlmaLinux ahead-of-RHEL fixes: CVE-2026-46316 (1374), ipv4/ipv6 fraggap (1384-1385) - RHEL changelog for 211.29.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759] - crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279} - Recreate RHEL 6.12.0-211.29.1 from CentOS Stream 10 and upstream stable backports (1386-1398) - Retain AlmaLinux ahead-of-RHEL fixes: CVE-2026-46316 (1374), ipv4/ipv6 fraggap (1384-1385) - RHEL changelog for 211.29.1 follows: - ipv6: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349] - ipv4: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349] - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189491] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182537] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182537] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182537] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182537] - ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions (CKI Backport Bot) [RHEL-185110] - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183965] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181936] {CVE-2026-46244} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179912] {CVE-2026-46209} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998} - rxrpc: Fix potential UAF after skb_unshare() failure (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998} - Recreate RHEL 6.12.0-211.30.1 from CentOS Stream 10 and upstream stable backports (1399-1414) - RHEL 6.12.0-211.30.1 now also carries the vgic-its (CVE-2026-46316) and ipv4/ipv6 fraggap fixes AlmaLinux shipped ahead; the AlmaLinux patches (1374, 1384-1385) are retained and RHEL's duplicate copies omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 211.30.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180776] - eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614} - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180776] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770] - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259} - net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140] - Recreate RHEL 6.12.0-211.31.1 from CentOS Stream 10 and upstream stable backports (1421-1444) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1417) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1418, 1420) - RHEL changelog for 211.31.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Recreate RHEL 6.12.0-211.33.1 from CentOS Stream 10 and upstream stable backports (1451-1455) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1445, 1446) are superseded by RHEL's copies and dropped - RHEL changelog for 211.33.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Recreate RHEL 6.12.0-211.33.1 from CentOS Stream 10 and upstream stable backports (1451-1455) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1445, 1446) are superseded by RHEL's copies and dropped - RHEL changelog for 211.33.1 follows: - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - Recreate RHEL 6.12.0-211.34.1 from CentOS Stream 10 and upstream stable backports (1456-1458) - RHEL changelog for 211.34.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180776] - eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614} - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180776] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770] - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259} - net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140] - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - selftests: kvm: Verify TILELOADD actually #NM faults when XFD[18]=1 (Maxim Levitsky) [RHEL-148618] - selftests: kvm: try getting XFD and XSAVE state out of sync (Maxim Levitsky) [RHEL-148618] - selftests: kvm: replace numbered sync points with actions (Maxim Levitsky) [RHEL-148618] - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Maxim Levitsky) [RHEL-148618] - KVM: selftests: Add ex_str() to print human friendly name of exception vectors (Maxim Levitsky) [RHEL-148618] - KVM: x86: Define AMD's #HV, #VC, and #SX exception vectors (Maxim Levitsky) [RHEL-148618] - KVM: x86: Define Control Protection Exception (#CP) vector (Maxim Levitsky) [RHEL-148618] - KVM: x86: Add human friendly formatting for #XM, and #VE (Maxim Levitsky) [RHEL-148618] - KVM: selftests: Add support for #DE exception fixup (Maxim Levitsky) [RHEL-148618] - idpf: export RX hardware timestamping information to XDP (Michal Schmidt) [RHEL-136674] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - redhat/configs: enable keyboard GPIO for x86 (Mark Langsdorf) [RHEL-147908] - redhat/configs: enable CONFIG_INPUT_SOC_BUTTON_ARRAY on x86 (Mark Langsdorf) [RHEL-135367] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-145800] - selftests/bpf: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - bpf: crypto: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - PCI: vmd: Override irq_startup()/irq_shutdown() in vmd_init_dev_msi_info() (Myron Stowe) [RHEL-143521] - PCI: vmd: Add VMD Device ID Support for Panther Lake (PTL)-H/P/U (Myron Stowe) [RHEL-143521] - net: vlan: don't propagate flags on open (Hangbin Liu) [RHEL-149691] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - redhat/configs: enable keyboard GPIO for x86 (Mark Langsdorf) [RHEL-147908] - redhat/configs: enable CONFIG_INPUT_SOC_BUTTON_ARRAY on x86 (Mark Langsdorf) [RHEL-135367] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-145800] - selftests/bpf: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - bpf: crypto: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - PCI: vmd: Override irq_startup()/irq_shutdown() in vmd_init_dev_msi_info() (Myron Stowe) [RHEL-143521] - PCI: vmd: Add VMD Device ID Support for Panther Lake (PTL)-H/P/U (Myron Stowe) [RHEL-143521] - net: vlan: don't propagate flags on open (Hangbin Liu) [RHEL-149691] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment() and tcp_clone_payload(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - ice: drop udp_tunnel_get_rx_info() call from ndo_open() (Mohammad Heib) [RHEL-165081] - i40e: drop udp_tunnel_get_rx_info() call from i40e_open() (Mohammad Heib) [RHEL-165081] - ALSA: hda/tas2781: Ignore reset check for SPI device (Jaroslav Kysela) [RHEL-157285] - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158990] - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159227] {CVE-2025-68741} - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Vinay Mulugund) [RHEL-155205] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-158206] - net: openvswitch: Avoid releasing netdev before teardown completes (Toke Høiland-Jørgensen) [RHEL-157946] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155971] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150456] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150456] {CVE-2025-39766} - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157855] - ASoC: soc_sdw_utils: remove index from sdca codec name (Jaroslav Kysela) [RHEL-163717] - ASoC: soc_sdw_utils: partial match the codec name (Jaroslav Kysela) [RHEL-163717] - ASoC: add snd_soc_lookup_component_by_name helper (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Update counting of SU/GE DAPM routes (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Handle CONFIG_PM_SLEEP not being set (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Tidy up some memory allocations (Jaroslav Kysela) [RHEL-163717] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157332] {CVE-2026-23270} - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-168569] {CVE-2026-31402} - KVM: x86/mmu: Only WARN in direct MMUs when overwriting shadow-present SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401} - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401} - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-169354] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-169354] - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166932] {CVE-2025-68724} - net: af_can: do not leave a dangling sk pointer in can_create() (CKI Backport Bot) [RHEL-162253] {CVE-2024-56603} - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171531] - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CKI Backport Bot) [RHEL-170974] {CVE-2026-31408} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172213] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172213] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172213] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172213] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172213] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172213] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172213] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172213] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172213] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172213] - xfrm: esp: avoid in-place decrypt on shared skb frags (CKI Backport Bot) [RHEL-174546] {CVE-2026-43284} - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176449] {CVE-2026-46333} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174029] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171434] {CVE-2026-31607} - Recreate RHEL 6.12.0-211.16.1 from CentOS Stream 10 and upstream stable backports (1106-1161) - Drop 211.7.x security-ahead patches superseded by the RHEL backports (1100-1104: crypto authencesn/algif, xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace) - Keep the smb cifs.spnego ahead-fix (1105) - RHEL changelog for 211.8.1..211.16.1 follows: - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169625] - redhat/kernel.spec.template: disable OBJTOOL_WERROR for gcov builds (Oleksii Baranov) - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174756] {CVE-2026-43303} - dpaa2-switch: validate num_ifs to prevent out-of-bounds write (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205} - dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205} - mm: thp: deny THP for files on anonymous inodes (Rafael Aquini) [RHEL-171617] {CVE-2026-23375} - fs: add S_ANON_INODE (Rafael Aquini) [RHEL-171617] - anon_inode: raise SB_I_NODEV and SB_I_NOEXEC (Rafael Aquini) [RHEL-171617] - pidfs: use anon_inode_setattr() (Rafael Aquini) [RHEL-171617] - anon_inode: explicitly block ->setattr() (Rafael Aquini) [RHEL-171617] - pidfs: use anon_inode_getattr() (Rafael Aquini) [RHEL-171617] - anon_inode: use a proper mode internally (Rafael Aquini) [RHEL-171617] - ice: set max queues in alloc_etherdev_mqs() (CKI Backport Bot) [RHEL-174331] - ice: use netif_get_num_default_rss_queues() (CKI Backport Bot) [RHEL-174331] - net: Fix rcu_tasks stall in threaded busypoll (CKI Backport Bot) [RHEL-170809] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174217] {CVE-2026-43190} - netfilter: ctnetlink: ensure safe access to master conntrack (CKI Backport Bot) [RHEL-173872] {CVE-2026-43116} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173857] {CVE-2026-43110} - redhat/configs: enable CONFIG_AQTION on all archs (CKI Backport Bot) [RHEL-171944] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172745] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172625] {CVE-2026-43027} - io_uring/rsrc: reject zero-length fixed buffer import (CKI Backport Bot) [RHEL-172556] {CVE-2026-43006} - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164434] - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-171637] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-171637] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171159] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171142] {CVE-2026-31684} - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150180] - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-169786] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-169786] - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166991] {CVE-2026-23455} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169738] {CVE-2025-68183} - can: j1939: j1939_session_new(): fix skb reference counting (CKI Backport Bot) [RHEL-162260] {CVE-2024-56645} - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160469] {CVE-2026-23392} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172603] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172577] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-133872] - Recreate RHEL 6.12.0-211.18.1 from CentOS Stream 10 and upstream stable backports (1162-1244) - RHEL changelog for 211.17.1..211.18.1 follows: - Bluetooth: hci_sync: Fix UAF in le_read_features_complete (David Marlin) [RHEL-176903] {CVE-2026-43322} - Bluetooth: hci_sync: fix leaks when hci_cmd_sync_queue_once fails (David Marlin) [RHEL-176903] - Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (David Marlin) [RHEL-176903] - Bluetooth: L2CAP: Add support for setting BT_PHY (David Marlin) [RHEL-176903] - Bluetooth: hci_conn: Fix using conn->le_{tx,rx}_phy as supported PHYs (David Marlin) [RHEL-176903] - Bluetooth: HCI: Add support for LL Extended Feature Set (David Marlin) [RHEL-176903] - Bluetooth: ISO: Add support to bind to trigger PAST (David Marlin) [RHEL-176903] - Bluetooth: HCI: Add initial support for PAST (David Marlin) [RHEL-176903] - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176915] {CVE-2026-43329} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175824] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175824] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175821] - dpll: add pin operational state (Ivan Vecera) [RHEL-175821] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172827] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172827] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172827] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172827] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172827] {CVE-2026-31709} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167837] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167837] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167837] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172930] - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (CKI Backport Bot) [RHEL-171302] - nbd: defer config unlock in nbd_genl_connect (CKI Backport Bot) [RHEL-166953] {CVE-2025-68366} - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163345] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163345] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163345] {CVE-2025-38653} - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178932] {CVE-2026-46243} - redhat/configs: automotive: disable CONFIG_IO_URING (Brian Masney) [RHEL-179469] - sched/deadline: Fix dl_server time accounting (Phil Auld) [RHEL-173950] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171475] {CVE-2026-31613} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157466] - Recreate RHEL 6.12.0-211.20.1 from CentOS Stream 10 and upstream stable backports (1245-1287) - smb cifs.spnego now shipped by RHEL too; existing ahead-fix 1105 is identical (RHEL's redundant copy omitted) - RHEL changelog for 211.19.1..211.20.1 follows: - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473] - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518] - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855] - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419} - scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932] - ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932] - ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932] - ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932] - ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932] - ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932] - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932] - scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932] - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037} - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581} - erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532} - nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788] - Recreate RHEL 6.12.0-211.22.1 from CentOS Stream 10 and upstream stable backports (1288-1352) - RHEL changelog for 211.21.1..211.22.1 follows: - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473] - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518] - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855] - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419} - scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932] - ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932] - ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932] - ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932] - ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932] - ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932] - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932] - scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932] - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037} - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581} - erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532} - nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788] - Recreate RHEL 6.12.0-211.22.1 from CentOS Stream 10 and upstream stable backports (1288-1352) - RHEL changelog for 211.21.1..211.22.1 follows: - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Mircea Dragan) [RHEL-166047] - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183319] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-179723] - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183127] - objtool/klp: Fix unexported static call key access for manually built livepatch modules (Joe Lawrence) [RHEL-178495] - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180307] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180126] {CVE-2026-46125} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180060] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180022] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179358] {CVE-2026-46056} - scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Ewan D. Milne) [RHEL-171774] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175533] {CVE-2026-31474} - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172516] {CVE-2026-31786} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172862] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172492] {CVE-2026-31787} - rxrpc: Fix RxGK token loading to check bounds (CKI Backport Bot) [RHEL-171419] {CVE-2026-31641} - gitlab-ci: use rhel10.2 builder image (Michael Krausch-Hofmann) - redhat/configs: enable watchdog pretimout panic functionality for x86 (David Arcari) [RHEL-182299] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (David Arcari) [RHEL-182299] - mptcp: fix slab-use-after-free in __inet_lookup_established (CKI Backport Bot) [RHEL-171510] {CVE-2026-31669} - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380] {CVE-2026-46331} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173} - crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172772] {CVE-2026-43056} - Recreate RHEL 6.12.0-211.26.1 from CentOS Stream 10 and upstream stable backports (1352-1373) - Enable watchdog pretimeout panic functionality for x86 via kernel config (RHEL-182299) - RHEL changelog for 211.23.1..211.26.1 follows: - nvmet-tcp: fix race between ICReq handling and queue teardown (CKI Backport Bot) [RHEL-180106] {CVE-2026-46135} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180090] {CVE-2026-46145} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172675] {CVE-2026-43038} - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-185117] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174242] {CVE-2026-43198} - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179755] {CVE-2026-43414} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180155] {CVE-2026-46117} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179665] {CVE-2026-45898} - rxrpc: fix RESPONSE authenticator parser OOB read (CKI Backport Bot) [RHEL-171456] {CVE-2026-31636} - Recreate RHEL 6.12.0-211.28.1 from CentOS Stream 10 and upstream stable backports (1375-1383) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1374) - RHEL changelog for 211.27.1..211.28.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759] - crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279} - Recreate RHEL 6.12.0-211.29.1 from CentOS Stream 10 and upstream stable backports (1386-1398) - Retain AlmaLinux ahead-of-RHEL fixes: CVE-2026-46316 (1374), ipv4/ipv6 fraggap (1384-1385) - RHEL changelog for 211.29.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759] - crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279} - Recreate RHEL 6.12.0-211.29.1 from CentOS Stream 10 and upstream stable backports (1386-1398) - Retain AlmaLinux ahead-of-RHEL fixes: CVE-2026-46316 (1374), ipv4/ipv6 fraggap (1384-1385) - RHEL changelog for 211.29.1 follows: - ipv6: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349] - ipv4: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349] - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189491] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182537] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182537] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182537] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182537] - ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions (CKI Backport Bot) [RHEL-185110] - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183965] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181936] {CVE-2026-46244} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179912] {CVE-2026-46209} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998} - rxrpc: Fix potential UAF after skb_unshare() failure (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998} - Recreate RHEL 6.12.0-211.30.1 from CentOS Stream 10 and upstream stable backports (1399-1414) - RHEL 6.12.0-211.30.1 now also carries the vgic-its (CVE-2026-46316) and ipv4/ipv6 fraggap fixes AlmaLinux shipped ahead; the AlmaLinux patches (1374, 1384-1385) are retained and RHEL's duplicate copies omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 211.30.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180776] - eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614} - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180776] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770] - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259} - net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140] - Recreate RHEL 6.12.0-211.31.1 from CentOS Stream 10 and upstream stable backports (1421-1444) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1417) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1418, 1420) - RHEL changelog for 211.31.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Recreate RHEL 6.12.0-211.33.1 from CentOS Stream 10 and upstream stable backports (1451-1455) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1445, 1446) are superseded by RHEL's copies and dropped - RHEL changelog for 211.33.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Recreate RHEL 6.12.0-211.33.1 from CentOS Stream 10 and upstream stable backports (1451-1455) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1445, 1446) are superseded by RHEL's copies and dropped - RHEL changelog for 211.33.1 follows: - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - Recreate RHEL 6.12.0-211.34.1 from CentOS Stream 10 and upstream stable backports (1456-1458) - RHEL changelog for 211.34.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180776] - eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614} - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180776] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770] - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259} - net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140] - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - selftests: kvm: Verify TILELOADD actually #NM faults when XFD[18]=1 (Maxim Levitsky) [RHEL-148618] - selftests: kvm: try getting XFD and XSAVE state out of sync (Maxim Levitsky) [RHEL-148618] - selftests: kvm: replace numbered sync points with actions (Maxim Levitsky) [RHEL-148618] - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Maxim Levitsky) [RHEL-148618] - KVM: selftests: Add ex_str() to print human friendly name of exception vectors (Maxim Levitsky) [RHEL-148618] - KVM: x86: Define AMD's #HV, #VC, and #SX exception vectors (Maxim Levitsky) [RHEL-148618] - KVM: x86: Define Control Protection Exception (#CP) vector (Maxim Levitsky) [RHEL-148618] - KVM: x86: Add human friendly formatting for #XM, and #VE (Maxim Levitsky) [RHEL-148618] - KVM: selftests: Add support for #DE exception fixup (Maxim Levitsky) [RHEL-148618] - idpf: export RX hardware timestamping information to XDP (Michal Schmidt) [RHEL-136674] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - redhat/configs: enable keyboard GPIO for x86 (Mark Langsdorf) [RHEL-147908] - redhat/configs: enable CONFIG_INPUT_SOC_BUTTON_ARRAY on x86 (Mark Langsdorf) [RHEL-135367] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-145800] - selftests/bpf: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - bpf: crypto: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - PCI: vmd: Override irq_startup()/irq_shutdown() in vmd_init_dev_msi_info() (Myron Stowe) [RHEL-143521] - PCI: vmd: Add VMD Device ID Support for Panther Lake (PTL)-H/P/U (Myron Stowe) [RHEL-143521] - net: vlan: don't propagate flags on open (Hangbin Liu) [RHEL-149691] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - redhat/configs: enable keyboard GPIO for x86 (Mark Langsdorf) [RHEL-147908] - redhat/configs: enable CONFIG_INPUT_SOC_BUTTON_ARRAY on x86 (Mark Langsdorf) [RHEL-135367] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-145800] - selftests/bpf: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - bpf: crypto: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - PCI: vmd: Override irq_startup()/irq_shutdown() in vmd_init_dev_msi_info() (Myron Stowe) [RHEL-143521] - PCI: vmd: Add VMD Device ID Support for Panther Lake (PTL)-H/P/U (Myron Stowe) [RHEL-143521] - net: vlan: don't propagate flags on open (Hangbin Liu) [RHEL-149691] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment() and tcp_clone_payload(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - ice: drop udp_tunnel_get_rx_info() call from ndo_open() (Mohammad Heib) [RHEL-165081] - i40e: drop udp_tunnel_get_rx_info() call from i40e_open() (Mohammad Heib) [RHEL-165081] - ALSA: hda/tas2781: Ignore reset check for SPI device (Jaroslav Kysela) [RHEL-157285] - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158990] - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159227] {CVE-2025-68741} - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Vinay Mulugund) [RHEL-155205] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-158206] - net: openvswitch: Avoid releasing netdev before teardown completes (Toke Høiland-Jørgensen) [RHEL-157946] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155971] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150456] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150456] {CVE-2025-39766} - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157855] - ASoC: soc_sdw_utils: remove index from sdca codec name (Jaroslav Kysela) [RHEL-163717] - ASoC: soc_sdw_utils: partial match the codec name (Jaroslav Kysela) [RHEL-163717] - ASoC: add snd_soc_lookup_component_by_name helper (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Update counting of SU/GE DAPM routes (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Handle CONFIG_PM_SLEEP not being set (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Tidy up some memory allocations (Jaroslav Kysela) [RHEL-163717] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157332] {CVE-2026-23270} - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-168569] {CVE-2026-31402} - KVM: x86/mmu: Only WARN in direct MMUs when overwriting shadow-present SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401} - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401} - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-169354] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-169354] - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166932] {CVE-2025-68724} - net: af_can: do not leave a dangling sk pointer in can_create() (CKI Backport Bot) [RHEL-162253] {CVE-2024-56603} - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171531] - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CKI Backport Bot) [RHEL-170974] {CVE-2026-31408} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172213] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172213] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172213] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172213] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172213] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172213] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172213] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172213] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172213] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172213] - xfrm: esp: avoid in-place decrypt on shared skb frags (CKI Backport Bot) [RHEL-174546] {CVE-2026-43284} - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176449] {CVE-2026-46333} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174029] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171434] {CVE-2026-31607} - Recreate RHEL 6.12.0-211.16.1 from CentOS Stream 10 and upstream stable backports (1106-1161) - Drop 211.7.x security-ahead patches superseded by the RHEL backports (1100-1104: crypto authencesn/algif, xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace) - Keep the smb cifs.spnego ahead-fix (1105) - RHEL changelog for 211.8.1..211.16.1 follows: - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169625] - redhat/kernel.spec.template: disable OBJTOOL_WERROR for gcov builds (Oleksii Baranov) - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174756] {CVE-2026-43303} - dpaa2-switch: validate num_ifs to prevent out-of-bounds write (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205} - dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205} - mm: thp: deny THP for files on anonymous inodes (Rafael Aquini) [RHEL-171617] {CVE-2026-23375} - fs: add S_ANON_INODE (Rafael Aquini) [RHEL-171617] - anon_inode: raise SB_I_NODEV and SB_I_NOEXEC (Rafael Aquini) [RHEL-171617] - pidfs: use anon_inode_setattr() (Rafael Aquini) [RHEL-171617] - anon_inode: explicitly block ->setattr() (Rafael Aquini) [RHEL-171617] - pidfs: use anon_inode_getattr() (Rafael Aquini) [RHEL-171617] - anon_inode: use a proper mode internally (Rafael Aquini) [RHEL-171617] - ice: set max queues in alloc_etherdev_mqs() (CKI Backport Bot) [RHEL-174331] - ice: use netif_get_num_default_rss_queues() (CKI Backport Bot) [RHEL-174331] - net: Fix rcu_tasks stall in threaded busypoll (CKI Backport Bot) [RHEL-170809] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174217] {CVE-2026-43190} - netfilter: ctnetlink: ensure safe access to master conntrack (CKI Backport Bot) [RHEL-173872] {CVE-2026-43116} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173857] {CVE-2026-43110} - redhat/configs: enable CONFIG_AQTION on all archs (CKI Backport Bot) [RHEL-171944] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172745] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172625] {CVE-2026-43027} - io_uring/rsrc: reject zero-length fixed buffer import (CKI Backport Bot) [RHEL-172556] {CVE-2026-43006} - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164434] - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-171637] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-171637] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171159] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171142] {CVE-2026-31684} - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150180] - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-169786] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-169786] - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166991] {CVE-2026-23455} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169738] {CVE-2025-68183} - can: j1939: j1939_session_new(): fix skb reference counting (CKI Backport Bot) [RHEL-162260] {CVE-2024-56645} - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160469] {CVE-2026-23392} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172603] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172577] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-133872] - Recreate RHEL 6.12.0-211.18.1 from CentOS Stream 10 and upstream stable backports (1162-1244) - RHEL changelog for 211.17.1..211.18.1 follows: - Bluetooth: hci_sync: Fix UAF in le_read_features_complete (David Marlin) [RHEL-176903] {CVE-2026-43322} - Bluetooth: hci_sync: fix leaks when hci_cmd_sync_queue_once fails (David Marlin) [RHEL-176903] - Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (David Marlin) [RHEL-176903] - Bluetooth: L2CAP: Add support for setting BT_PHY (David Marlin) [RHEL-176903] - Bluetooth: hci_conn: Fix using conn->le_{tx,rx}_phy as supported PHYs (David Marlin) [RHEL-176903] - Bluetooth: HCI: Add support for LL Extended Feature Set (David Marlin) [RHEL-176903] - Bluetooth: ISO: Add support to bind to trigger PAST (David Marlin) [RHEL-176903] - Bluetooth: HCI: Add initial support for PAST (David Marlin) [RHEL-176903] - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176915] {CVE-2026-43329} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175824] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175824] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175821] - dpll: add pin operational state (Ivan Vecera) [RHEL-175821] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172827] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172827] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172827] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172827] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172827] {CVE-2026-31709} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167837] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167837] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167837] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172930] - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (CKI Backport Bot) [RHEL-171302] - nbd: defer config unlock in nbd_genl_connect (CKI Backport Bot) [RHEL-166953] {CVE-2025-68366} - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163345] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163345] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163345] {CVE-2025-38653} - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178932] {CVE-2026-46243} - redhat/configs: automotive: disable CONFIG_IO_URING (Brian Masney) [RHEL-179469] - sched/deadline: Fix dl_server time accounting (Phil Auld) [RHEL-173950] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171475] {CVE-2026-31613} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157466] - Recreate RHEL 6.12.0-211.20.1 from CentOS Stream 10 and upstream stable backports (1245-1287) - smb cifs.spnego now shipped by RHEL too; existing ahead-fix 1105 is identical (RHEL's redundant copy omitted) - RHEL changelog for 211.19.1..211.20.1 follows: - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473] - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518] - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855] - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419} - scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932] - ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932] - ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932] - ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932] - ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932] - ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932] - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932] - scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932] - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037} - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581} - erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532} - nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788] - Recreate RHEL 6.12.0-211.22.1 from CentOS Stream 10 and upstream stable backports (1288-1352) - RHEL changelog for 211.21.1..211.22.1 follows: - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473] - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518] - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855] - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419} - scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932] - ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932] - ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932] - ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932] - ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932] - ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932] - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932] - scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932] - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037} - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581} - erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532} - nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788] - Recreate RHEL 6.12.0-211.22.1 from CentOS Stream 10 and upstream stable backports (1288-1352) - RHEL changelog for 211.21.1..211.22.1 follows: - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Mircea Dragan) [RHEL-166047] - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183319] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-179723] - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183127] - objtool/klp: Fix unexported static call key access for manually built livepatch modules (Joe Lawrence) [RHEL-178495] - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180307] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180126] {CVE-2026-46125} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180060] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180022] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179358] {CVE-2026-46056} - scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Ewan D. Milne) [RHEL-171774] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175533] {CVE-2026-31474} - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172516] {CVE-2026-31786} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172862] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172492] {CVE-2026-31787} - rxrpc: Fix RxGK token loading to check bounds (CKI Backport Bot) [RHEL-171419] {CVE-2026-31641} - gitlab-ci: use rhel10.2 builder image (Michael Krausch-Hofmann) - redhat/configs: enable watchdog pretimout panic functionality for x86 (David Arcari) [RHEL-182299] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (David Arcari) [RHEL-182299] - mptcp: fix slab-use-after-free in __inet_lookup_established (CKI Backport Bot) [RHEL-171510] {CVE-2026-31669} - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380] {CVE-2026-46331} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173} - crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172772] {CVE-2026-43056} - Recreate RHEL 6.12.0-211.26.1 from CentOS Stream 10 and upstream stable backports (1352-1373) - Enable watchdog pretimeout panic functionality for x86 via kernel config (RHEL-182299) - RHEL changelog for 211.23.1..211.26.1 follows: - nvmet-tcp: fix race between ICReq handling and queue teardown (CKI Backport Bot) [RHEL-180106] {CVE-2026-46135} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180090] {CVE-2026-46145} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172675] {CVE-2026-43038} - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-185117] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174242] {CVE-2026-43198} - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179755] {CVE-2026-43414} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180155] {CVE-2026-46117} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179665] {CVE-2026-45898} - rxrpc: fix RESPONSE authenticator parser OOB read (CKI Backport Bot) [RHEL-171456] {CVE-2026-31636} - Recreate RHEL 6.12.0-211.28.1 from CentOS Stream 10 and upstream stable backports (1375-1383) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1374) - RHEL changelog for 211.27.1..211.28.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759] - crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279} - Recreate RHEL 6.12.0-211.29.1 from CentOS Stream 10 and upstream stable backports (1386-1398) - Retain AlmaLinux ahead-of-RHEL fixes: CVE-2026-46316 (1374), ipv4/ipv6 fraggap (1384-1385) - RHEL changelog for 211.29.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759] - crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279} - Recreate RHEL 6.12.0-211.29.1 from CentOS Stream 10 and upstream stable backports (1386-1398) - Retain AlmaLinux ahead-of-RHEL fixes: CVE-2026-46316 (1374), ipv4/ipv6 fraggap (1384-1385) - RHEL changelog for 211.29.1 follows: - ipv6: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349] - ipv4: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349] - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189491] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182537] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182537] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182537] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182537] - ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions (CKI Backport Bot) [RHEL-185110] - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183965] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181936] {CVE-2026-46244} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179912] {CVE-2026-46209} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998} - rxrpc: Fix potential UAF after skb_unshare() failure (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998} - Recreate RHEL 6.12.0-211.30.1 from CentOS Stream 10 and upstream stable backports (1399-1414) - RHEL 6.12.0-211.30.1 now also carries the vgic-its (CVE-2026-46316) and ipv4/ipv6 fraggap fixes AlmaLinux shipped ahead; the AlmaLinux patches (1374, 1384-1385) are retained and RHEL's duplicate copies omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 211.30.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180776] - eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614} - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180776] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770] - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259} - net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140] - Recreate RHEL 6.12.0-211.31.1 from CentOS Stream 10 and upstream stable backports (1421-1444) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1417) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1418, 1420) - RHEL changelog for 211.31.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Recreate RHEL 6.12.0-211.33.1 from CentOS Stream 10 and upstream stable backports (1451-1455) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1445, 1446) are superseded by RHEL's copies and dropped - RHEL changelog for 211.33.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Recreate RHEL 6.12.0-211.33.1 from CentOS Stream 10 and upstream stable backports (1451-1455) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1445, 1446) are superseded by RHEL's copies and dropped - RHEL changelog for 211.33.1 follows: - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - Recreate RHEL 6.12.0-211.34.1 from CentOS Stream 10 and upstream stable backports (1456-1458) - RHEL changelog for 211.34.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180776] - eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614} - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180776] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770] - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259} - net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140] - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - selftests: kvm: Verify TILELOADD actually #NM faults when XFD[18]=1 (Maxim Levitsky) [RHEL-148618] - selftests: kvm: try getting XFD and XSAVE state out of sync (Maxim Levitsky) [RHEL-148618] - selftests: kvm: replace numbered sync points with actions (Maxim Levitsky) [RHEL-148618] - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Maxim Levitsky) [RHEL-148618] - KVM: selftests: Add ex_str() to print human friendly name of exception vectors (Maxim Levitsky) [RHEL-148618] - KVM: x86: Define AMD's #HV, #VC, and #SX exception vectors (Maxim Levitsky) [RHEL-148618] - KVM: x86: Define Control Protection Exception (#CP) vector (Maxim Levitsky) [RHEL-148618] - KVM: x86: Add human friendly formatting for #XM, and #VE (Maxim Levitsky) [RHEL-148618] - KVM: selftests: Add support for #DE exception fixup (Maxim Levitsky) [RHEL-148618] - idpf: export RX hardware timestamping information to XDP (Michal Schmidt) [RHEL-136674] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - redhat/configs: enable keyboard GPIO for x86 (Mark Langsdorf) [RHEL-147908] - redhat/configs: enable CONFIG_INPUT_SOC_BUTTON_ARRAY on x86 (Mark Langsdorf) [RHEL-135367] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-145800] - selftests/bpf: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - bpf: crypto: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - PCI: vmd: Override irq_startup()/irq_shutdown() in vmd_init_dev_msi_info() (Myron Stowe) [RHEL-143521] - PCI: vmd: Add VMD Device ID Support for Panther Lake (PTL)-H/P/U (Myron Stowe) [RHEL-143521] - net: vlan: don't propagate flags on open (Hangbin Liu) [RHEL-149691] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - redhat/configs: enable keyboard GPIO for x86 (Mark Langsdorf) [RHEL-147908] - redhat/configs: enable CONFIG_INPUT_SOC_BUTTON_ARRAY on x86 (Mark Langsdorf) [RHEL-135367] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-145800] - selftests/bpf: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - bpf: crypto: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - PCI: vmd: Override irq_startup()/irq_shutdown() in vmd_init_dev_msi_info() (Myron Stowe) [RHEL-143521] - PCI: vmd: Add VMD Device ID Support for Panther Lake (PTL)-H/P/U (Myron Stowe) [RHEL-143521] - net: vlan: don't propagate flags on open (Hangbin Liu) [RHEL-149691] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment() and tcp_clone_payload(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - ice: drop udp_tunnel_get_rx_info() call from ndo_open() (Mohammad Heib) [RHEL-165081] - i40e: drop udp_tunnel_get_rx_info() call from i40e_open() (Mohammad Heib) [RHEL-165081] - ALSA: hda/tas2781: Ignore reset check for SPI device (Jaroslav Kysela) [RHEL-157285] - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158990] - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159227] {CVE-2025-68741} - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Vinay Mulugund) [RHEL-155205] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-158206] - net: openvswitch: Avoid releasing netdev before teardown completes (Toke Høiland-Jørgensen) [RHEL-157946] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155971] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150456] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150456] {CVE-2025-39766} - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157855] - ASoC: soc_sdw_utils: remove index from sdca codec name (Jaroslav Kysela) [RHEL-163717] - ASoC: soc_sdw_utils: partial match the codec name (Jaroslav Kysela) [RHEL-163717] - ASoC: add snd_soc_lookup_component_by_name helper (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Update counting of SU/GE DAPM routes (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Handle CONFIG_PM_SLEEP not being set (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Tidy up some memory allocations (Jaroslav Kysela) [RHEL-163717] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157332] {CVE-2026-23270} - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-168569] {CVE-2026-31402} - KVM: x86/mmu: Only WARN in direct MMUs when overwriting shadow-present SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401} - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401} - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-169354] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-169354] - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166932] {CVE-2025-68724} - net: af_can: do not leave a dangling sk pointer in can_create() (CKI Backport Bot) [RHEL-162253] {CVE-2024-56603} - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171531] - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CKI Backport Bot) [RHEL-170974] {CVE-2026-31408} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172213] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172213] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172213] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172213] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172213] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172213] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172213] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172213] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172213] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172213] - xfrm: esp: avoid in-place decrypt on shared skb frags (CKI Backport Bot) [RHEL-174546] {CVE-2026-43284} - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176449] {CVE-2026-46333} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174029] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171434] {CVE-2026-31607} - Recreate RHEL 6.12.0-211.16.1 from CentOS Stream 10 and upstream stable backports (1106-1161) - Drop 211.7.x security-ahead patches superseded by the RHEL backports (1100-1104: crypto authencesn/algif, xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace) - Keep the smb cifs.spnego ahead-fix (1105) - RHEL changelog for 211.8.1..211.16.1 follows: - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169625] - redhat/kernel.spec.template: disable OBJTOOL_WERROR for gcov builds (Oleksii Baranov) - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174756] {CVE-2026-43303} - dpaa2-switch: validate num_ifs to prevent out-of-bounds write (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205} - dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205} - mm: thp: deny THP for files on anonymous inodes (Rafael Aquini) [RHEL-171617] {CVE-2026-23375} - fs: add S_ANON_INODE (Rafael Aquini) [RHEL-171617] - anon_inode: raise SB_I_NODEV and SB_I_NOEXEC (Rafael Aquini) [RHEL-171617] - pidfs: use anon_inode_setattr() (Rafael Aquini) [RHEL-171617] - anon_inode: explicitly block ->setattr() (Rafael Aquini) [RHEL-171617] - pidfs: use anon_inode_getattr() (Rafael Aquini) [RHEL-171617] - anon_inode: use a proper mode internally (Rafael Aquini) [RHEL-171617] - ice: set max queues in alloc_etherdev_mqs() (CKI Backport Bot) [RHEL-174331] - ice: use netif_get_num_default_rss_queues() (CKI Backport Bot) [RHEL-174331] - net: Fix rcu_tasks stall in threaded busypoll (CKI Backport Bot) [RHEL-170809] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174217] {CVE-2026-43190} - netfilter: ctnetlink: ensure safe access to master conntrack (CKI Backport Bot) [RHEL-173872] {CVE-2026-43116} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173857] {CVE-2026-43110} - redhat/configs: enable CONFIG_AQTION on all archs (CKI Backport Bot) [RHEL-171944] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172745] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172625] {CVE-2026-43027} - io_uring/rsrc: reject zero-length fixed buffer import (CKI Backport Bot) [RHEL-172556] {CVE-2026-43006} - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164434] - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-171637] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-171637] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171159] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171142] {CVE-2026-31684} - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150180] - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-169786] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-169786] - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166991] {CVE-2026-23455} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169738] {CVE-2025-68183} - can: j1939: j1939_session_new(): fix skb reference counting (CKI Backport Bot) [RHEL-162260] {CVE-2024-56645} - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160469] {CVE-2026-23392} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172603] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172577] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-133872] - Recreate RHEL 6.12.0-211.18.1 from CentOS Stream 10 and upstream stable backports (1162-1244) - RHEL changelog for 211.17.1..211.18.1 follows: - Bluetooth: hci_sync: Fix UAF in le_read_features_complete (David Marlin) [RHEL-176903] {CVE-2026-43322} - Bluetooth: hci_sync: fix leaks when hci_cmd_sync_queue_once fails (David Marlin) [RHEL-176903] - Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (David Marlin) [RHEL-176903] - Bluetooth: L2CAP: Add support for setting BT_PHY (David Marlin) [RHEL-176903] - Bluetooth: hci_conn: Fix using conn->le_{tx,rx}_phy as supported PHYs (David Marlin) [RHEL-176903] - Bluetooth: HCI: Add support for LL Extended Feature Set (David Marlin) [RHEL-176903] - Bluetooth: ISO: Add support to bind to trigger PAST (David Marlin) [RHEL-176903] - Bluetooth: HCI: Add initial support for PAST (David Marlin) [RHEL-176903] - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176915] {CVE-2026-43329} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175824] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175824] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175821] - dpll: add pin operational state (Ivan Vecera) [RHEL-175821] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172827] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172827] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172827] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172827] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172827] {CVE-2026-31709} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167837] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167837] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167837] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172930] - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (CKI Backport Bot) [RHEL-171302] - nbd: defer config unlock in nbd_genl_connect (CKI Backport Bot) [RHEL-166953] {CVE-2025-68366} - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163345] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163345] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163345] {CVE-2025-38653} - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178932] {CVE-2026-46243} - redhat/configs: automotive: disable CONFIG_IO_URING (Brian Masney) [RHEL-179469] - sched/deadline: Fix dl_server time accounting (Phil Auld) [RHEL-173950] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171475] {CVE-2026-31613} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157466] - Recreate RHEL 6.12.0-211.20.1 from CentOS Stream 10 and upstream stable backports (1245-1287) - smb cifs.spnego now shipped by RHEL too; existing ahead-fix 1105 is identical (RHEL's redundant copy omitted) - RHEL changelog for 211.19.1..211.20.1 follows: - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473] - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518] - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855] - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419} - scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932] - ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932] - ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932] - ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932] - ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932] - ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932] - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932] - scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932] - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037} - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581} - erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532} - nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788] - Recreate RHEL 6.12.0-211.22.1 from CentOS Stream 10 and upstream stable backports (1288-1352) - RHEL changelog for 211.21.1..211.22.1 follows: - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473] - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518] - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855] - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419} - scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932] - ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932] - ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932] - ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932] - ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932] - ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932] - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932] - scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932] - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037} - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581} - erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532} - nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788] - Recreate RHEL 6.12.0-211.22.1 from CentOS Stream 10 and upstream stable backports (1288-1352) - RHEL changelog for 211.21.1..211.22.1 follows: - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Mircea Dragan) [RHEL-166047] - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183319] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-179723] - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183127] - objtool/klp: Fix unexported static call key access for manually built livepatch modules (Joe Lawrence) [RHEL-178495] - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180307] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180126] {CVE-2026-46125} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180060] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180022] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179358] {CVE-2026-46056} - scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Ewan D. Milne) [RHEL-171774] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175533] {CVE-2026-31474} - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172516] {CVE-2026-31786} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172862] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172492] {CVE-2026-31787} - rxrpc: Fix RxGK token loading to check bounds (CKI Backport Bot) [RHEL-171419] {CVE-2026-31641} - gitlab-ci: use rhel10.2 builder image (Michael Krausch-Hofmann) - redhat/configs: enable watchdog pretimout panic functionality for x86 (David Arcari) [RHEL-182299] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (David Arcari) [RHEL-182299] - mptcp: fix slab-use-after-free in __inet_lookup_established (CKI Backport Bot) [RHEL-171510] {CVE-2026-31669} - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380] {CVE-2026-46331} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173} - crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172772] {CVE-2026-43056} - Recreate RHEL 6.12.0-211.26.1 from CentOS Stream 10 and upstream stable backports (1352-1373) - Enable watchdog pretimeout panic functionality for x86 via kernel config (RHEL-182299) - RHEL changelog for 211.23.1..211.26.1 follows: - nvmet-tcp: fix race between ICReq handling and queue teardown (CKI Backport Bot) [RHEL-180106] {CVE-2026-46135} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180090] {CVE-2026-46145} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172675] {CVE-2026-43038} - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-185117] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174242] {CVE-2026-43198} - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179755] {CVE-2026-43414} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180155] {CVE-2026-46117} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179665] {CVE-2026-45898} - rxrpc: fix RESPONSE authenticator parser OOB read (CKI Backport Bot) [RHEL-171456] {CVE-2026-31636} - Recreate RHEL 6.12.0-211.28.1 from CentOS Stream 10 and upstream stable backports (1375-1383) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1374) - RHEL changelog for 211.27.1..211.28.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759] - crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279} - Recreate RHEL 6.12.0-211.29.1 from CentOS Stream 10 and upstream stable backports (1386-1398) - Retain AlmaLinux ahead-of-RHEL fixes: CVE-2026-46316 (1374), ipv4/ipv6 fraggap (1384-1385) - RHEL changelog for 211.29.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759] - crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279} - Recreate RHEL 6.12.0-211.29.1 from CentOS Stream 10 and upstream stable backports (1386-1398) - Retain AlmaLinux ahead-of-RHEL fixes: CVE-2026-46316 (1374), ipv4/ipv6 fraggap (1384-1385) - RHEL changelog for 211.29.1 follows: - ipv6: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349] - ipv4: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349] - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189491] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182537] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182537] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182537] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182537] - ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions (CKI Backport Bot) [RHEL-185110] - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183965] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181936] {CVE-2026-46244} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179912] {CVE-2026-46209} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998} - rxrpc: Fix potential UAF after skb_unshare() failure (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998} - Recreate RHEL 6.12.0-211.30.1 from CentOS Stream 10 and upstream stable backports (1399-1414) - RHEL 6.12.0-211.30.1 now also carries the vgic-its (CVE-2026-46316) and ipv4/ipv6 fraggap fixes AlmaLinux shipped ahead; the AlmaLinux patches (1374, 1384-1385) are retained and RHEL's duplicate copies omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 211.30.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180776] - eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614} - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180776] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770] - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259} - net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140] - Recreate RHEL 6.12.0-211.31.1 from CentOS Stream 10 and upstream stable backports (1421-1444) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1417) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1418, 1420) - RHEL changelog for 211.31.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Recreate RHEL 6.12.0-211.33.1 from CentOS Stream 10 and upstream stable backports (1451-1455) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1445, 1446) are superseded by RHEL's copies and dropped - RHEL changelog for 211.33.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Recreate RHEL 6.12.0-211.33.1 from CentOS Stream 10 and upstream stable backports (1451-1455) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1445, 1446) are superseded by RHEL's copies and dropped - RHEL changelog for 211.33.1 follows: - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - Recreate RHEL 6.12.0-211.34.1 from CentOS Stream 10 and upstream stable backports (1456-1458) - RHEL changelog for 211.34.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180776] - eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614} - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180776] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770] - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259} - net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140] - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - selftests: kvm: Verify TILELOADD actually #NM faults when XFD[18]=1 (Maxim Levitsky) [RHEL-148618] - selftests: kvm: try getting XFD and XSAVE state out of sync (Maxim Levitsky) [RHEL-148618] - selftests: kvm: replace numbered sync points with actions (Maxim Levitsky) [RHEL-148618] - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Maxim Levitsky) [RHEL-148618] - KVM: selftests: Add ex_str() to print human friendly name of exception vectors (Maxim Levitsky) [RHEL-148618] - KVM: x86: Define AMD's #HV, #VC, and #SX exception vectors (Maxim Levitsky) [RHEL-148618] - KVM: x86: Define Control Protection Exception (#CP) vector (Maxim Levitsky) [RHEL-148618] - KVM: x86: Add human friendly formatting for #XM, and #VE (Maxim Levitsky) [RHEL-148618] - KVM: selftests: Add support for #DE exception fixup (Maxim Levitsky) [RHEL-148618] - idpf: export RX hardware timestamping information to XDP (Michal Schmidt) [RHEL-136674] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - redhat/configs: enable keyboard GPIO for x86 (Mark Langsdorf) [RHEL-147908] - redhat/configs: enable CONFIG_INPUT_SOC_BUTTON_ARRAY on x86 (Mark Langsdorf) [RHEL-135367] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-145800] - selftests/bpf: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - bpf: crypto: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - PCI: vmd: Override irq_startup()/irq_shutdown() in vmd_init_dev_msi_info() (Myron Stowe) [RHEL-143521] - PCI: vmd: Add VMD Device ID Support for Panther Lake (PTL)-H/P/U (Myron Stowe) [RHEL-143521] - net: vlan: don't propagate flags on open (Hangbin Liu) [RHEL-149691] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - redhat/configs: enable keyboard GPIO for x86 (Mark Langsdorf) [RHEL-147908] - redhat/configs: enable CONFIG_INPUT_SOC_BUTTON_ARRAY on x86 (Mark Langsdorf) [RHEL-135367] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-145800] - selftests/bpf: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - bpf: crypto: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - PCI: vmd: Override irq_startup()/irq_shutdown() in vmd_init_dev_msi_info() (Myron Stowe) [RHEL-143521] - PCI: vmd: Add VMD Device ID Support for Panther Lake (PTL)-H/P/U (Myron Stowe) [RHEL-143521] - net: vlan: don't propagate flags on open (Hangbin Liu) [RHEL-149691] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment() and tcp_clone_payload(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - ice: drop udp_tunnel_get_rx_info() call from ndo_open() (Mohammad Heib) [RHEL-165081] - i40e: drop udp_tunnel_get_rx_info() call from i40e_open() (Mohammad Heib) [RHEL-165081] - ALSA: hda/tas2781: Ignore reset check for SPI device (Jaroslav Kysela) [RHEL-157285] - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158990] - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159227] {CVE-2025-68741} - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Vinay Mulugund) [RHEL-155205] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-158206] - net: openvswitch: Avoid releasing netdev before teardown completes (Toke Høiland-Jørgensen) [RHEL-157946] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155971] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150456] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150456] {CVE-2025-39766} - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157855] - ASoC: soc_sdw_utils: remove index from sdca codec name (Jaroslav Kysela) [RHEL-163717] - ASoC: soc_sdw_utils: partial match the codec name (Jaroslav Kysela) [RHEL-163717] - ASoC: add snd_soc_lookup_component_by_name helper (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Update counting of SU/GE DAPM routes (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Handle CONFIG_PM_SLEEP not being set (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Tidy up some memory allocations (Jaroslav Kysela) [RHEL-163717] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157332] {CVE-2026-23270} - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-168569] {CVE-2026-31402} - KVM: x86/mmu: Only WARN in direct MMUs when overwriting shadow-present SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401} - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401} - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-169354] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-169354] - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166932] {CVE-2025-68724} - net: af_can: do not leave a dangling sk pointer in can_create() (CKI Backport Bot) [RHEL-162253] {CVE-2024-56603} - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171531] - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CKI Backport Bot) [RHEL-170974] {CVE-2026-31408} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172213] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172213] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172213] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172213] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172213] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172213] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172213] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172213] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172213] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172213] - xfrm: esp: avoid in-place decrypt on shared skb frags (CKI Backport Bot) [RHEL-174546] {CVE-2026-43284} - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176449] {CVE-2026-46333} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174029] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171434] {CVE-2026-31607} - Recreate RHEL 6.12.0-211.16.1 from CentOS Stream 10 and upstream stable backports (1106-1161) - Drop 211.7.x security-ahead patches superseded by the RHEL backports (1100-1104: crypto authencesn/algif, xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace) - Keep the smb cifs.spnego ahead-fix (1105) - RHEL changelog for 211.8.1..211.16.1 follows: - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169625] - redhat/kernel.spec.template: disable OBJTOOL_WERROR for gcov builds (Oleksii Baranov) - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174756] {CVE-2026-43303} - dpaa2-switch: validate num_ifs to prevent out-of-bounds write (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205} - dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205} - mm: thp: deny THP for files on anonymous inodes (Rafael Aquini) [RHEL-171617] {CVE-2026-23375} - fs: add S_ANON_INODE (Rafael Aquini) [RHEL-171617] - anon_inode: raise SB_I_NODEV and SB_I_NOEXEC (Rafael Aquini) [RHEL-171617] - pidfs: use anon_inode_setattr() (Rafael Aquini) [RHEL-171617] - anon_inode: explicitly block ->setattr() (Rafael Aquini) [RHEL-171617] - pidfs: use anon_inode_getattr() (Rafael Aquini) [RHEL-171617] - anon_inode: use a proper mode internally (Rafael Aquini) [RHEL-171617] - ice: set max queues in alloc_etherdev_mqs() (CKI Backport Bot) [RHEL-174331] - ice: use netif_get_num_default_rss_queues() (CKI Backport Bot) [RHEL-174331] - net: Fix rcu_tasks stall in threaded busypoll (CKI Backport Bot) [RHEL-170809] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174217] {CVE-2026-43190} - netfilter: ctnetlink: ensure safe access to master conntrack (CKI Backport Bot) [RHEL-173872] {CVE-2026-43116} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173857] {CVE-2026-43110} - redhat/configs: enable CONFIG_AQTION on all archs (CKI Backport Bot) [RHEL-171944] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172745] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172625] {CVE-2026-43027} - io_uring/rsrc: reject zero-length fixed buffer import (CKI Backport Bot) [RHEL-172556] {CVE-2026-43006} - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164434] - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-171637] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-171637] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171159] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171142] {CVE-2026-31684} - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150180] - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-169786] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-169786] - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166991] {CVE-2026-23455} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169738] {CVE-2025-68183} - can: j1939: j1939_session_new(): fix skb reference counting (CKI Backport Bot) [RHEL-162260] {CVE-2024-56645} - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160469] {CVE-2026-23392} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172603] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172577] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-133872] - Recreate RHEL 6.12.0-211.18.1 from CentOS Stream 10 and upstream stable backports (1162-1244) - RHEL changelog for 211.17.1..211.18.1 follows: - Bluetooth: hci_sync: Fix UAF in le_read_features_complete (David Marlin) [RHEL-176903] {CVE-2026-43322} - Bluetooth: hci_sync: fix leaks when hci_cmd_sync_queue_once fails (David Marlin) [RHEL-176903] - Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (David Marlin) [RHEL-176903] - Bluetooth: L2CAP: Add support for setting BT_PHY (David Marlin) [RHEL-176903] - Bluetooth: hci_conn: Fix using conn->le_{tx,rx}_phy as supported PHYs (David Marlin) [RHEL-176903] - Bluetooth: HCI: Add support for LL Extended Feature Set (David Marlin) [RHEL-176903] - Bluetooth: ISO: Add support to bind to trigger PAST (David Marlin) [RHEL-176903] - Bluetooth: HCI: Add initial support for PAST (David Marlin) [RHEL-176903] - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176915] {CVE-2026-43329} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175824] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175824] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175821] - dpll: add pin operational state (Ivan Vecera) [RHEL-175821] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172827] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172827] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172827] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172827] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172827] {CVE-2026-31709} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167837] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167837] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167837] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172930] - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (CKI Backport Bot) [RHEL-171302] - nbd: defer config unlock in nbd_genl_connect (CKI Backport Bot) [RHEL-166953] {CVE-2025-68366} - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163345] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163345] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163345] {CVE-2025-38653} - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178932] {CVE-2026-46243} - redhat/configs: automotive: disable CONFIG_IO_URING (Brian Masney) [RHEL-179469] - sched/deadline: Fix dl_server time accounting (Phil Auld) [RHEL-173950] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171475] {CVE-2026-31613} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157466] - Recreate RHEL 6.12.0-211.20.1 from CentOS Stream 10 and upstream stable backports (1245-1287) - smb cifs.spnego now shipped by RHEL too; existing ahead-fix 1105 is identical (RHEL's redundant copy omitted) - RHEL changelog for 211.19.1..211.20.1 follows: - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473] - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518] - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855] - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419} - scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932] - ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932] - ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932] - ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932] - ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932] - ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932] - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932] - scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932] - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037} - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581} - erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532} - nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788] - Recreate RHEL 6.12.0-211.22.1 from CentOS Stream 10 and upstream stable backports (1288-1352) - RHEL changelog for 211.21.1..211.22.1 follows: - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473] - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518] - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855] - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419} - scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932] - ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932] - ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932] - ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932] - ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932] - ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932] - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932] - scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932] - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037} - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581} - erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532} - nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788] - Recreate RHEL 6.12.0-211.22.1 from CentOS Stream 10 and upstream stable backports (1288-1352) - RHEL changelog for 211.21.1..211.22.1 follows: - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Mircea Dragan) [RHEL-166047] - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183319] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-179723] - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183127] - objtool/klp: Fix unexported static call key access for manually built livepatch modules (Joe Lawrence) [RHEL-178495] - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180307] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180126] {CVE-2026-46125} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180060] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180022] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179358] {CVE-2026-46056} - scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Ewan D. Milne) [RHEL-171774] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175533] {CVE-2026-31474} - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172516] {CVE-2026-31786} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172862] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172492] {CVE-2026-31787} - rxrpc: Fix RxGK token loading to check bounds (CKI Backport Bot) [RHEL-171419] {CVE-2026-31641} - gitlab-ci: use rhel10.2 builder image (Michael Krausch-Hofmann) - redhat/configs: enable watchdog pretimout panic functionality for x86 (David Arcari) [RHEL-182299] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (David Arcari) [RHEL-182299] - mptcp: fix slab-use-after-free in __inet_lookup_established (CKI Backport Bot) [RHEL-171510] {CVE-2026-31669} - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380] {CVE-2026-46331} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173} - crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172772] {CVE-2026-43056} - Recreate RHEL 6.12.0-211.26.1 from CentOS Stream 10 and upstream stable backports (1352-1373) - Enable watchdog pretimeout panic functionality for x86 via kernel config (RHEL-182299) - RHEL changelog for 211.23.1..211.26.1 follows: - nvmet-tcp: fix race between ICReq handling and queue teardown (CKI Backport Bot) [RHEL-180106] {CVE-2026-46135} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180090] {CVE-2026-46145} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172675] {CVE-2026-43038} - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-185117] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174242] {CVE-2026-43198} - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179755] {CVE-2026-43414} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180155] {CVE-2026-46117} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179665] {CVE-2026-45898} - rxrpc: fix RESPONSE authenticator parser OOB read (CKI Backport Bot) [RHEL-171456] {CVE-2026-31636} - Recreate RHEL 6.12.0-211.28.1 from CentOS Stream 10 and upstream stable backports (1375-1383) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1374) - RHEL changelog for 211.27.1..211.28.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759] - crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279} - Recreate RHEL 6.12.0-211.29.1 from CentOS Stream 10 and upstream stable backports (1386-1398) - Retain AlmaLinux ahead-of-RHEL fixes: CVE-2026-46316 (1374), ipv4/ipv6 fraggap (1384-1385) - RHEL changelog for 211.29.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759] - crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279} - Recreate RHEL 6.12.0-211.29.1 from CentOS Stream 10 and upstream stable backports (1386-1398) - Retain AlmaLinux ahead-of-RHEL fixes: CVE-2026-46316 (1374), ipv4/ipv6 fraggap (1384-1385) - RHEL changelog for 211.29.1 follows: - ipv6: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349] - ipv4: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349] - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189491] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182537] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182537] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182537] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182537] - ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions (CKI Backport Bot) [RHEL-185110] - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183965] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181936] {CVE-2026-46244} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179912] {CVE-2026-46209} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998} - rxrpc: Fix potential UAF after skb_unshare() failure (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998} - Recreate RHEL 6.12.0-211.30.1 from CentOS Stream 10 and upstream stable backports (1399-1414) - RHEL 6.12.0-211.30.1 now also carries the vgic-its (CVE-2026-46316) and ipv4/ipv6 fraggap fixes AlmaLinux shipped ahead; the AlmaLinux patches (1374, 1384-1385) are retained and RHEL's duplicate copies omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 211.30.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180776] - eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614} - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180776] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770] - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259} - net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140] - Recreate RHEL 6.12.0-211.31.1 from CentOS Stream 10 and upstream stable backports (1421-1444) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1417) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1418, 1420) - RHEL changelog for 211.31.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Recreate RHEL 6.12.0-211.33.1 from CentOS Stream 10 and upstream stable backports (1451-1455) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1445, 1446) are superseded by RHEL's copies and dropped - RHEL changelog for 211.33.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Recreate RHEL 6.12.0-211.33.1 from CentOS Stream 10 and upstream stable backports (1451-1455) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1445, 1446) are superseded by RHEL's copies and dropped - RHEL changelog for 211.33.1 follows: - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - Recreate RHEL 6.12.0-211.34.1 from CentOS Stream 10 and upstream stable backports (1456-1458) - RHEL changelog for 211.34.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180776] - eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614} - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180776] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770] - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259} - net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140] - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - selftests: kvm: Verify TILELOADD actually #NM faults when XFD[18]=1 (Maxim Levitsky) [RHEL-148618] - selftests: kvm: try getting XFD and XSAVE state out of sync (Maxim Levitsky) [RHEL-148618] - selftests: kvm: replace numbered sync points with actions (Maxim Levitsky) [RHEL-148618] - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Maxim Levitsky) [RHEL-148618] - KVM: selftests: Add ex_str() to print human friendly name of exception vectors (Maxim Levitsky) [RHEL-148618] - KVM: x86: Define AMD's #HV, #VC, and #SX exception vectors (Maxim Levitsky) [RHEL-148618] - KVM: x86: Define Control Protection Exception (#CP) vector (Maxim Levitsky) [RHEL-148618] - KVM: x86: Add human friendly formatting for #XM, and #VE (Maxim Levitsky) [RHEL-148618] - KVM: selftests: Add support for #DE exception fixup (Maxim Levitsky) [RHEL-148618] - idpf: export RX hardware timestamping information to XDP (Michal Schmidt) [RHEL-136674] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - redhat/configs: enable keyboard GPIO for x86 (Mark Langsdorf) [RHEL-147908] - redhat/configs: enable CONFIG_INPUT_SOC_BUTTON_ARRAY on x86 (Mark Langsdorf) [RHEL-135367] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-145800] - selftests/bpf: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - bpf: crypto: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - PCI: vmd: Override irq_startup()/irq_shutdown() in vmd_init_dev_msi_info() (Myron Stowe) [RHEL-143521] - PCI: vmd: Add VMD Device ID Support for Panther Lake (PTL)-H/P/U (Myron Stowe) [RHEL-143521] - net: vlan: don't propagate flags on open (Hangbin Liu) [RHEL-149691] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - redhat/configs: enable keyboard GPIO for x86 (Mark Langsdorf) [RHEL-147908] - redhat/configs: enable CONFIG_INPUT_SOC_BUTTON_ARRAY on x86 (Mark Langsdorf) [RHEL-135367] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-145800] - selftests/bpf: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - bpf: crypto: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - PCI: vmd: Override irq_startup()/irq_shutdown() in vmd_init_dev_msi_info() (Myron Stowe) [RHEL-143521] - PCI: vmd: Add VMD Device ID Support for Panther Lake (PTL)-H/P/U (Myron Stowe) [RHEL-143521] - net: vlan: don't propagate flags on open (Hangbin Liu) [RHEL-149691] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment() and tcp_clone_payload(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - ice: drop udp_tunnel_get_rx_info() call from ndo_open() (Mohammad Heib) [RHEL-165081] - i40e: drop udp_tunnel_get_rx_info() call from i40e_open() (Mohammad Heib) [RHEL-165081] - ALSA: hda/tas2781: Ignore reset check for SPI device (Jaroslav Kysela) [RHEL-157285] - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158990] - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159227] {CVE-2025-68741} - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Vinay Mulugund) [RHEL-155205] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-158206] - net: openvswitch: Avoid releasing netdev before teardown completes (Toke Høiland-Jørgensen) [RHEL-157946] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155971] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150456] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150456] {CVE-2025-39766} - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157855] - ASoC: soc_sdw_utils: remove index from sdca codec name (Jaroslav Kysela) [RHEL-163717] - ASoC: soc_sdw_utils: partial match the codec name (Jaroslav Kysela) [RHEL-163717] - ASoC: add snd_soc_lookup_component_by_name helper (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Update counting of SU/GE DAPM routes (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Handle CONFIG_PM_SLEEP not being set (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Tidy up some memory allocations (Jaroslav Kysela) [RHEL-163717] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157332] {CVE-2026-23270} - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-168569] {CVE-2026-31402} - KVM: x86/mmu: Only WARN in direct MMUs when overwriting shadow-present SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401} - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401} - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-169354] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-169354] - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166932] {CVE-2025-68724} - net: af_can: do not leave a dangling sk pointer in can_create() (CKI Backport Bot) [RHEL-162253] {CVE-2024-56603} - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171531] - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CKI Backport Bot) [RHEL-170974] {CVE-2026-31408} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172213] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172213] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172213] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172213] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172213] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172213] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172213] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172213] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172213] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172213] - xfrm: esp: avoid in-place decrypt on shared skb frags (CKI Backport Bot) [RHEL-174546] {CVE-2026-43284} - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176449] {CVE-2026-46333} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174029] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171434] {CVE-2026-31607} - Recreate RHEL 6.12.0-211.16.1 from CentOS Stream 10 and upstream stable backports (1106-1161) - Drop 211.7.x security-ahead patches superseded by the RHEL backports (1100-1104: crypto authencesn/algif, xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace) - Keep the smb cifs.spnego ahead-fix (1105) - RHEL changelog for 211.8.1..211.16.1 follows: - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169625] - redhat/kernel.spec.template: disable OBJTOOL_WERROR for gcov builds (Oleksii Baranov) - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174756] {CVE-2026-43303} - dpaa2-switch: validate num_ifs to prevent out-of-bounds write (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205} - dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205} - mm: thp: deny THP for files on anonymous inodes (Rafael Aquini) [RHEL-171617] {CVE-2026-23375} - fs: add S_ANON_INODE (Rafael Aquini) [RHEL-171617] - anon_inode: raise SB_I_NODEV and SB_I_NOEXEC (Rafael Aquini) [RHEL-171617] - pidfs: use anon_inode_setattr() (Rafael Aquini) [RHEL-171617] - anon_inode: explicitly block ->setattr() (Rafael Aquini) [RHEL-171617] - pidfs: use anon_inode_getattr() (Rafael Aquini) [RHEL-171617] - anon_inode: use a proper mode internally (Rafael Aquini) [RHEL-171617] - ice: set max queues in alloc_etherdev_mqs() (CKI Backport Bot) [RHEL-174331] - ice: use netif_get_num_default_rss_queues() (CKI Backport Bot) [RHEL-174331] - net: Fix rcu_tasks stall in threaded busypoll (CKI Backport Bot) [RHEL-170809] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174217] {CVE-2026-43190} - netfilter: ctnetlink: ensure safe access to master conntrack (CKI Backport Bot) [RHEL-173872] {CVE-2026-43116} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173857] {CVE-2026-43110} - redhat/configs: enable CONFIG_AQTION on all archs (CKI Backport Bot) [RHEL-171944] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172745] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172625] {CVE-2026-43027} - io_uring/rsrc: reject zero-length fixed buffer import (CKI Backport Bot) [RHEL-172556] {CVE-2026-43006} - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164434] - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-171637] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-171637] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171159] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171142] {CVE-2026-31684} - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150180] - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-169786] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-169786] - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166991] {CVE-2026-23455} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169738] {CVE-2025-68183} - can: j1939: j1939_session_new(): fix skb reference counting (CKI Backport Bot) [RHEL-162260] {CVE-2024-56645} - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160469] {CVE-2026-23392} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172603] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172577] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-133872] - Recreate RHEL 6.12.0-211.18.1 from CentOS Stream 10 and upstream stable backports (1162-1244) - RHEL changelog for 211.17.1..211.18.1 follows: - Bluetooth: hci_sync: Fix UAF in le_read_features_complete (David Marlin) [RHEL-176903] {CVE-2026-43322} - Bluetooth: hci_sync: fix leaks when hci_cmd_sync_queue_once fails (David Marlin) [RHEL-176903] - Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (David Marlin) [RHEL-176903] - Bluetooth: L2CAP: Add support for setting BT_PHY (David Marlin) [RHEL-176903] - Bluetooth: hci_conn: Fix using conn->le_{tx,rx}_phy as supported PHYs (David Marlin) [RHEL-176903] - Bluetooth: HCI: Add support for LL Extended Feature Set (David Marlin) [RHEL-176903] - Bluetooth: ISO: Add support to bind to trigger PAST (David Marlin) [RHEL-176903] - Bluetooth: HCI: Add initial support for PAST (David Marlin) [RHEL-176903] - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176915] {CVE-2026-43329} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175824] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175824] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175821] - dpll: add pin operational state (Ivan Vecera) [RHEL-175821] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172827] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172827] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172827] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172827] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172827] {CVE-2026-31709} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167837] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167837] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167837] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172930] - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (CKI Backport Bot) [RHEL-171302] - nbd: defer config unlock in nbd_genl_connect (CKI Backport Bot) [RHEL-166953] {CVE-2025-68366} - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163345] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163345] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163345] {CVE-2025-38653} - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178932] {CVE-2026-46243} - redhat/configs: automotive: disable CONFIG_IO_URING (Brian Masney) [RHEL-179469] - sched/deadline: Fix dl_server time accounting (Phil Auld) [RHEL-173950] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171475] {CVE-2026-31613} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157466] - Recreate RHEL 6.12.0-211.20.1 from CentOS Stream 10 and upstream stable backports (1245-1287) - smb cifs.spnego now shipped by RHEL too; existing ahead-fix 1105 is identical (RHEL's redundant copy omitted) - RHEL changelog for 211.19.1..211.20.1 follows: - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473] - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518] - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855] - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419} - scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932] - ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932] - ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932] - ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932] - ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932] - ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932] - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932] - scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932] - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037} - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581} - erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532} - nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788] - Recreate RHEL 6.12.0-211.22.1 from CentOS Stream 10 and upstream stable backports (1288-1352) - RHEL changelog for 211.21.1..211.22.1 follows: - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473] - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518] - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855] - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419} - scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932] - ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932] - ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932] - ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932] - ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932] - ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932] - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932] - scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932] - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037} - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581} - erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532} - nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788] - Recreate RHEL 6.12.0-211.22.1 from CentOS Stream 10 and upstream stable backports (1288-1352) - RHEL changelog for 211.21.1..211.22.1 follows: - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Mircea Dragan) [RHEL-166047] - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183319] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-179723] - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183127] - objtool/klp: Fix unexported static call key access for manually built livepatch modules (Joe Lawrence) [RHEL-178495] - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180307] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180126] {CVE-2026-46125} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180060] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180022] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179358] {CVE-2026-46056} - scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Ewan D. Milne) [RHEL-171774] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175533] {CVE-2026-31474} - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172516] {CVE-2026-31786} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172862] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172492] {CVE-2026-31787} - rxrpc: Fix RxGK token loading to check bounds (CKI Backport Bot) [RHEL-171419] {CVE-2026-31641} - gitlab-ci: use rhel10.2 builder image (Michael Krausch-Hofmann) - redhat/configs: enable watchdog pretimout panic functionality for x86 (David Arcari) [RHEL-182299] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (David Arcari) [RHEL-182299] - mptcp: fix slab-use-after-free in __inet_lookup_established (CKI Backport Bot) [RHEL-171510] {CVE-2026-31669} - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380] {CVE-2026-46331} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173} - crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172772] {CVE-2026-43056} - Recreate RHEL 6.12.0-211.26.1 from CentOS Stream 10 and upstream stable backports (1352-1373) - Enable watchdog pretimeout panic functionality for x86 via kernel config (RHEL-182299) - RHEL changelog for 211.23.1..211.26.1 follows: - nvmet-tcp: fix race between ICReq handling and queue teardown (CKI Backport Bot) [RHEL-180106] {CVE-2026-46135} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180090] {CVE-2026-46145} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172675] {CVE-2026-43038} - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-185117] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174242] {CVE-2026-43198} - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179755] {CVE-2026-43414} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180155] {CVE-2026-46117} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179665] {CVE-2026-45898} - rxrpc: fix RESPONSE authenticator parser OOB read (CKI Backport Bot) [RHEL-171456] {CVE-2026-31636} - Recreate RHEL 6.12.0-211.28.1 from CentOS Stream 10 and upstream stable backports (1375-1383) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1374) - RHEL changelog for 211.27.1..211.28.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759] - crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279} - Recreate RHEL 6.12.0-211.29.1 from CentOS Stream 10 and upstream stable backports (1386-1398) - Retain AlmaLinux ahead-of-RHEL fixes: CVE-2026-46316 (1374), ipv4/ipv6 fraggap (1384-1385) - RHEL changelog for 211.29.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759] - crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279} - Recreate RHEL 6.12.0-211.29.1 from CentOS Stream 10 and upstream stable backports (1386-1398) - Retain AlmaLinux ahead-of-RHEL fixes: CVE-2026-46316 (1374), ipv4/ipv6 fraggap (1384-1385) - RHEL changelog for 211.29.1 follows: - ipv6: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349] - ipv4: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349] - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189491] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182537] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182537] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182537] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182537] - ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions (CKI Backport Bot) [RHEL-185110] - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183965] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181936] {CVE-2026-46244} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179912] {CVE-2026-46209} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998} - rxrpc: Fix potential UAF after skb_unshare() failure (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998} - Recreate RHEL 6.12.0-211.30.1 from CentOS Stream 10 and upstream stable backports (1399-1414) - RHEL 6.12.0-211.30.1 now also carries the vgic-its (CVE-2026-46316) and ipv4/ipv6 fraggap fixes AlmaLinux shipped ahead; the AlmaLinux patches (1374, 1384-1385) are retained and RHEL's duplicate copies omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 211.30.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180776] - eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614} - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180776] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770] - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259} - net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140] - Recreate RHEL 6.12.0-211.31.1 from CentOS Stream 10 and upstream stable backports (1421-1444) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1417) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1418, 1420) - RHEL changelog for 211.31.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Recreate RHEL 6.12.0-211.33.1 from CentOS Stream 10 and upstream stable backports (1451-1455) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1445, 1446) are superseded by RHEL's copies and dropped - RHEL changelog for 211.33.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Recreate RHEL 6.12.0-211.33.1 from CentOS Stream 10 and upstream stable backports (1451-1455) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1445, 1446) are superseded by RHEL's copies and dropped - RHEL changelog for 211.33.1 follows: - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - Recreate RHEL 6.12.0-211.34.1 from CentOS Stream 10 and upstream stable backports (1456-1458) - RHEL changelog for 211.34.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180776] - eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614} - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180776] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770] - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259} - net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140] - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - selftests: kvm: Verify TILELOADD actually #NM faults when XFD[18]=1 (Maxim Levitsky) [RHEL-148618] - selftests: kvm: try getting XFD and XSAVE state out of sync (Maxim Levitsky) [RHEL-148618] - selftests: kvm: replace numbered sync points with actions (Maxim Levitsky) [RHEL-148618] - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Maxim Levitsky) [RHEL-148618] - KVM: selftests: Add ex_str() to print human friendly name of exception vectors (Maxim Levitsky) [RHEL-148618] - KVM: x86: Define AMD's #HV, #VC, and #SX exception vectors (Maxim Levitsky) [RHEL-148618] - KVM: x86: Define Control Protection Exception (#CP) vector (Maxim Levitsky) [RHEL-148618] - KVM: x86: Add human friendly formatting for #XM, and #VE (Maxim Levitsky) [RHEL-148618] - KVM: selftests: Add support for #DE exception fixup (Maxim Levitsky) [RHEL-148618] - idpf: export RX hardware timestamping information to XDP (Michal Schmidt) [RHEL-136674] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - redhat/configs: enable keyboard GPIO for x86 (Mark Langsdorf) [RHEL-147908] - redhat/configs: enable CONFIG_INPUT_SOC_BUTTON_ARRAY on x86 (Mark Langsdorf) [RHEL-135367] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-145800] - selftests/bpf: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - bpf: crypto: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - PCI: vmd: Override irq_startup()/irq_shutdown() in vmd_init_dev_msi_info() (Myron Stowe) [RHEL-143521] - PCI: vmd: Add VMD Device ID Support for Panther Lake (PTL)-H/P/U (Myron Stowe) [RHEL-143521] - net: vlan: don't propagate flags on open (Hangbin Liu) [RHEL-149691] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - redhat/configs: enable keyboard GPIO for x86 (Mark Langsdorf) [RHEL-147908] - redhat/configs: enable CONFIG_INPUT_SOC_BUTTON_ARRAY on x86 (Mark Langsdorf) [RHEL-135367] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-145800] - selftests/bpf: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - bpf: crypto: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - PCI: vmd: Override irq_startup()/irq_shutdown() in vmd_init_dev_msi_info() (Myron Stowe) [RHEL-143521] - PCI: vmd: Add VMD Device ID Support for Panther Lake (PTL)-H/P/U (Myron Stowe) [RHEL-143521] - net: vlan: don't propagate flags on open (Hangbin Liu) [RHEL-149691] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment() and tcp_clone_payload(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - ice: drop udp_tunnel_get_rx_info() call from ndo_open() (Mohammad Heib) [RHEL-165081] - i40e: drop udp_tunnel_get_rx_info() call from i40e_open() (Mohammad Heib) [RHEL-165081] - ALSA: hda/tas2781: Ignore reset check for SPI device (Jaroslav Kysela) [RHEL-157285] - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158990] - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159227] {CVE-2025-68741} - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Vinay Mulugund) [RHEL-155205] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-158206] - net: openvswitch: Avoid releasing netdev before teardown completes (Toke Høiland-Jørgensen) [RHEL-157946] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155971] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150456] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150456] {CVE-2025-39766} - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157855] - ASoC: soc_sdw_utils: remove index from sdca codec name (Jaroslav Kysela) [RHEL-163717] - ASoC: soc_sdw_utils: partial match the codec name (Jaroslav Kysela) [RHEL-163717] - ASoC: add snd_soc_lookup_component_by_name helper (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Update counting of SU/GE DAPM routes (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Handle CONFIG_PM_SLEEP not being set (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Tidy up some memory allocations (Jaroslav Kysela) [RHEL-163717] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157332] {CVE-2026-23270} - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-168569] {CVE-2026-31402} - KVM: x86/mmu: Only WARN in direct MMUs when overwriting shadow-present SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401} - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401} - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-169354] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-169354] - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166932] {CVE-2025-68724} - net: af_can: do not leave a dangling sk pointer in can_create() (CKI Backport Bot) [RHEL-162253] {CVE-2024-56603} - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171531] - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CKI Backport Bot) [RHEL-170974] {CVE-2026-31408} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172213] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172213] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172213] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172213] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172213] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172213] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172213] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172213] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172213] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172213] - xfrm: esp: avoid in-place decrypt on shared skb frags (CKI Backport Bot) [RHEL-174546] {CVE-2026-43284} - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176449] {CVE-2026-46333} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174029] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171434] {CVE-2026-31607} - Recreate RHEL 6.12.0-211.16.1 from CentOS Stream 10 and upstream stable backports (1106-1161) - Drop 211.7.x security-ahead patches superseded by the RHEL backports (1100-1104: crypto authencesn/algif, xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace) - Keep the smb cifs.spnego ahead-fix (1105) - RHEL changelog for 211.8.1..211.16.1 follows: - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169625] - redhat/kernel.spec.template: disable OBJTOOL_WERROR for gcov builds (Oleksii Baranov) - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174756] {CVE-2026-43303} - dpaa2-switch: validate num_ifs to prevent out-of-bounds write (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205} - dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205} - mm: thp: deny THP for files on anonymous inodes (Rafael Aquini) [RHEL-171617] {CVE-2026-23375} - fs: add S_ANON_INODE (Rafael Aquini) [RHEL-171617] - anon_inode: raise SB_I_NODEV and SB_I_NOEXEC (Rafael Aquini) [RHEL-171617] - pidfs: use anon_inode_setattr() (Rafael Aquini) [RHEL-171617] - anon_inode: explicitly block ->setattr() (Rafael Aquini) [RHEL-171617] - pidfs: use anon_inode_getattr() (Rafael Aquini) [RHEL-171617] - anon_inode: use a proper mode internally (Rafael Aquini) [RHEL-171617] - ice: set max queues in alloc_etherdev_mqs() (CKI Backport Bot) [RHEL-174331] - ice: use netif_get_num_default_rss_queues() (CKI Backport Bot) [RHEL-174331] - net: Fix rcu_tasks stall in threaded busypoll (CKI Backport Bot) [RHEL-170809] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174217] {CVE-2026-43190} - netfilter: ctnetlink: ensure safe access to master conntrack (CKI Backport Bot) [RHEL-173872] {CVE-2026-43116} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173857] {CVE-2026-43110} - redhat/configs: enable CONFIG_AQTION on all archs (CKI Backport Bot) [RHEL-171944] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172745] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172625] {CVE-2026-43027} - io_uring/rsrc: reject zero-length fixed buffer import (CKI Backport Bot) [RHEL-172556] {CVE-2026-43006} - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164434] - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-171637] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-171637] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171159] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171142] {CVE-2026-31684} - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150180] - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-169786] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-169786] - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166991] {CVE-2026-23455} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169738] {CVE-2025-68183} - can: j1939: j1939_session_new(): fix skb reference counting (CKI Backport Bot) [RHEL-162260] {CVE-2024-56645} - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160469] {CVE-2026-23392} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172603] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172577] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-133872] - Recreate RHEL 6.12.0-211.18.1 from CentOS Stream 10 and upstream stable backports (1162-1244) - RHEL changelog for 211.17.1..211.18.1 follows: - Bluetooth: hci_sync: Fix UAF in le_read_features_complete (David Marlin) [RHEL-176903] {CVE-2026-43322} - Bluetooth: hci_sync: fix leaks when hci_cmd_sync_queue_once fails (David Marlin) [RHEL-176903] - Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (David Marlin) [RHEL-176903] - Bluetooth: L2CAP: Add support for setting BT_PHY (David Marlin) [RHEL-176903] - Bluetooth: hci_conn: Fix using conn->le_{tx,rx}_phy as supported PHYs (David Marlin) [RHEL-176903] - Bluetooth: HCI: Add support for LL Extended Feature Set (David Marlin) [RHEL-176903] - Bluetooth: ISO: Add support to bind to trigger PAST (David Marlin) [RHEL-176903] - Bluetooth: HCI: Add initial support for PAST (David Marlin) [RHEL-176903] - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176915] {CVE-2026-43329} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175824] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175824] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175821] - dpll: add pin operational state (Ivan Vecera) [RHEL-175821] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172827] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172827] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172827] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172827] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172827] {CVE-2026-31709} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167837] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167837] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167837] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172930] - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (CKI Backport Bot) [RHEL-171302] - nbd: defer config unlock in nbd_genl_connect (CKI Backport Bot) [RHEL-166953] {CVE-2025-68366} - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163345] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163345] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163345] {CVE-2025-38653} - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178932] {CVE-2026-46243} - redhat/configs: automotive: disable CONFIG_IO_URING (Brian Masney) [RHEL-179469] - sched/deadline: Fix dl_server time accounting (Phil Auld) [RHEL-173950] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171475] {CVE-2026-31613} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157466] - Recreate RHEL 6.12.0-211.20.1 from CentOS Stream 10 and upstream stable backports (1245-1287) - smb cifs.spnego now shipped by RHEL too; existing ahead-fix 1105 is identical (RHEL's redundant copy omitted) - RHEL changelog for 211.19.1..211.20.1 follows: - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473] - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518] - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855] - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419} - scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932] - ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932] - ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932] - ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932] - ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932] - ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932] - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932] - scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932] - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037} - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581} - erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532} - nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788] - Recreate RHEL 6.12.0-211.22.1 from CentOS Stream 10 and upstream stable backports (1288-1352) - RHEL changelog for 211.21.1..211.22.1 follows: - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473] - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518] - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855] - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419} - scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932] - ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932] - ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932] - ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932] - ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932] - ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932] - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932] - scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932] - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037} - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581} - erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532} - nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788] - Recreate RHEL 6.12.0-211.22.1 from CentOS Stream 10 and upstream stable backports (1288-1352) - RHEL changelog for 211.21.1..211.22.1 follows: - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Mircea Dragan) [RHEL-166047] - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183319] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-179723] - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183127] - objtool/klp: Fix unexported static call key access for manually built livepatch modules (Joe Lawrence) [RHEL-178495] - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180307] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180126] {CVE-2026-46125} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180060] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180022] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179358] {CVE-2026-46056} - scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Ewan D. Milne) [RHEL-171774] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175533] {CVE-2026-31474} - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172516] {CVE-2026-31786} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172862] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172492] {CVE-2026-31787} - rxrpc: Fix RxGK token loading to check bounds (CKI Backport Bot) [RHEL-171419] {CVE-2026-31641} - gitlab-ci: use rhel10.2 builder image (Michael Krausch-Hofmann) - redhat/configs: enable watchdog pretimout panic functionality for x86 (David Arcari) [RHEL-182299] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (David Arcari) [RHEL-182299] - mptcp: fix slab-use-after-free in __inet_lookup_established (CKI Backport Bot) [RHEL-171510] {CVE-2026-31669} - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380] {CVE-2026-46331} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173} - crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172772] {CVE-2026-43056} - Recreate RHEL 6.12.0-211.26.1 from CentOS Stream 10 and upstream stable backports (1352-1373) - Enable watchdog pretimeout panic functionality for x86 via kernel config (RHEL-182299) - RHEL changelog for 211.23.1..211.26.1 follows: - nvmet-tcp: fix race between ICReq handling and queue teardown (CKI Backport Bot) [RHEL-180106] {CVE-2026-46135} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180090] {CVE-2026-46145} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172675] {CVE-2026-43038} - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-185117] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174242] {CVE-2026-43198} - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179755] {CVE-2026-43414} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180155] {CVE-2026-46117} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179665] {CVE-2026-45898} - rxrpc: fix RESPONSE authenticator parser OOB read (CKI Backport Bot) [RHEL-171456] {CVE-2026-31636} - Recreate RHEL 6.12.0-211.28.1 from CentOS Stream 10 and upstream stable backports (1375-1383) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1374) - RHEL changelog for 211.27.1..211.28.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759] - crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279} - Recreate RHEL 6.12.0-211.29.1 from CentOS Stream 10 and upstream stable backports (1386-1398) - Retain AlmaLinux ahead-of-RHEL fixes: CVE-2026-46316 (1374), ipv4/ipv6 fraggap (1384-1385) - RHEL changelog for 211.29.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759] - crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279} - Recreate RHEL 6.12.0-211.29.1 from CentOS Stream 10 and upstream stable backports (1386-1398) - Retain AlmaLinux ahead-of-RHEL fixes: CVE-2026-46316 (1374), ipv4/ipv6 fraggap (1384-1385) - RHEL changelog for 211.29.1 follows: - ipv6: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349] - ipv4: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349] - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189491] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182537] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182537] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182537] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182537] - ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions (CKI Backport Bot) [RHEL-185110] - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183965] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181936] {CVE-2026-46244} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179912] {CVE-2026-46209} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998} - rxrpc: Fix potential UAF after skb_unshare() failure (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998} - Recreate RHEL 6.12.0-211.30.1 from CentOS Stream 10 and upstream stable backports (1399-1414) - RHEL 6.12.0-211.30.1 now also carries the vgic-its (CVE-2026-46316) and ipv4/ipv6 fraggap fixes AlmaLinux shipped ahead; the AlmaLinux patches (1374, 1384-1385) are retained and RHEL's duplicate copies omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 211.30.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180776] - eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614} - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180776] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770] - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259} - net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140] - Recreate RHEL 6.12.0-211.31.1 from CentOS Stream 10 and upstream stable backports (1421-1444) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1417) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1418, 1420) - RHEL changelog for 211.31.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Recreate RHEL 6.12.0-211.33.1 from CentOS Stream 10 and upstream stable backports (1451-1455) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1445, 1446) are superseded by RHEL's copies and dropped - RHEL changelog for 211.33.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Recreate RHEL 6.12.0-211.33.1 from CentOS Stream 10 and upstream stable backports (1451-1455) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1445, 1446) are superseded by RHEL's copies and dropped - RHEL changelog for 211.33.1 follows: - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - Recreate RHEL 6.12.0-211.34.1 from CentOS Stream 10 and upstream stable backports (1456-1458) - RHEL changelog for 211.34.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180776] - eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614} - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180776] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770] - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259} - net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140] - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - selftests: kvm: Verify TILELOADD actually #NM faults when XFD[18]=1 (Maxim Levitsky) [RHEL-148618] - selftests: kvm: try getting XFD and XSAVE state out of sync (Maxim Levitsky) [RHEL-148618] - selftests: kvm: replace numbered sync points with actions (Maxim Levitsky) [RHEL-148618] - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Maxim Levitsky) [RHEL-148618] - KVM: selftests: Add ex_str() to print human friendly name of exception vectors (Maxim Levitsky) [RHEL-148618] - KVM: x86: Define AMD's #HV, #VC, and #SX exception vectors (Maxim Levitsky) [RHEL-148618] - KVM: x86: Define Control Protection Exception (#CP) vector (Maxim Levitsky) [RHEL-148618] - KVM: x86: Add human friendly formatting for #XM, and #VE (Maxim Levitsky) [RHEL-148618] - KVM: selftests: Add support for #DE exception fixup (Maxim Levitsky) [RHEL-148618] - idpf: export RX hardware timestamping information to XDP (Michal Schmidt) [RHEL-136674] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - redhat/configs: enable keyboard GPIO for x86 (Mark Langsdorf) [RHEL-147908] - redhat/configs: enable CONFIG_INPUT_SOC_BUTTON_ARRAY on x86 (Mark Langsdorf) [RHEL-135367] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-145800] - selftests/bpf: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - bpf: crypto: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - PCI: vmd: Override irq_startup()/irq_shutdown() in vmd_init_dev_msi_info() (Myron Stowe) [RHEL-143521] - PCI: vmd: Add VMD Device ID Support for Panther Lake (PTL)-H/P/U (Myron Stowe) [RHEL-143521] - net: vlan: don't propagate flags on open (Hangbin Liu) [RHEL-149691] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - redhat/configs: enable keyboard GPIO for x86 (Mark Langsdorf) [RHEL-147908] - redhat/configs: enable CONFIG_INPUT_SOC_BUTTON_ARRAY on x86 (Mark Langsdorf) [RHEL-135367] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-145800] - selftests/bpf: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - bpf: crypto: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - PCI: vmd: Override irq_startup()/irq_shutdown() in vmd_init_dev_msi_info() (Myron Stowe) [RHEL-143521] - PCI: vmd: Add VMD Device ID Support for Panther Lake (PTL)-H/P/U (Myron Stowe) [RHEL-143521] - net: vlan: don't propagate flags on open (Hangbin Liu) [RHEL-149691] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment() and tcp_clone_payload(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - ice: drop udp_tunnel_get_rx_info() call from ndo_open() (Mohammad Heib) [RHEL-165081] - i40e: drop udp_tunnel_get_rx_info() call from i40e_open() (Mohammad Heib) [RHEL-165081] - ALSA: hda/tas2781: Ignore reset check for SPI device (Jaroslav Kysela) [RHEL-157285] - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158990] - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159227] {CVE-2025-68741} - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Vinay Mulugund) [RHEL-155205] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-158206] - net: openvswitch: Avoid releasing netdev before teardown completes (Toke Høiland-Jørgensen) [RHEL-157946] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155971] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150456] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150456] {CVE-2025-39766} - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157855] - ASoC: soc_sdw_utils: remove index from sdca codec name (Jaroslav Kysela) [RHEL-163717] - ASoC: soc_sdw_utils: partial match the codec name (Jaroslav Kysela) [RHEL-163717] - ASoC: add snd_soc_lookup_component_by_name helper (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Update counting of SU/GE DAPM routes (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Handle CONFIG_PM_SLEEP not being set (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Tidy up some memory allocations (Jaroslav Kysela) [RHEL-163717] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157332] {CVE-2026-23270} - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-168569] {CVE-2026-31402} - KVM: x86/mmu: Only WARN in direct MMUs when overwriting shadow-present SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401} - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401} - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-169354] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-169354] - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166932] {CVE-2025-68724} - net: af_can: do not leave a dangling sk pointer in can_create() (CKI Backport Bot) [RHEL-162253] {CVE-2024-56603} - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171531] - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CKI Backport Bot) [RHEL-170974] {CVE-2026-31408} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172213] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172213] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172213] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172213] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172213] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172213] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172213] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172213] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172213] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172213] - xfrm: esp: avoid in-place decrypt on shared skb frags (CKI Backport Bot) [RHEL-174546] {CVE-2026-43284} - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176449] {CVE-2026-46333} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174029] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171434] {CVE-2026-31607} - Recreate RHEL 6.12.0-211.16.1 from CentOS Stream 10 and upstream stable backports (1106-1161) - Drop 211.7.x security-ahead patches superseded by the RHEL backports (1100-1104: crypto authencesn/algif, xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace) - Keep the smb cifs.spnego ahead-fix (1105) - RHEL changelog for 211.8.1..211.16.1 follows: - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169625] - redhat/kernel.spec.template: disable OBJTOOL_WERROR for gcov builds (Oleksii Baranov) - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174756] {CVE-2026-43303} - dpaa2-switch: validate num_ifs to prevent out-of-bounds write (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205} - dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205} - mm: thp: deny THP for files on anonymous inodes (Rafael Aquini) [RHEL-171617] {CVE-2026-23375} - fs: add S_ANON_INODE (Rafael Aquini) [RHEL-171617] - anon_inode: raise SB_I_NODEV and SB_I_NOEXEC (Rafael Aquini) [RHEL-171617] - pidfs: use anon_inode_setattr() (Rafael Aquini) [RHEL-171617] - anon_inode: explicitly block ->setattr() (Rafael Aquini) [RHEL-171617] - pidfs: use anon_inode_getattr() (Rafael Aquini) [RHEL-171617] - anon_inode: use a proper mode internally (Rafael Aquini) [RHEL-171617] - ice: set max queues in alloc_etherdev_mqs() (CKI Backport Bot) [RHEL-174331] - ice: use netif_get_num_default_rss_queues() (CKI Backport Bot) [RHEL-174331] - net: Fix rcu_tasks stall in threaded busypoll (CKI Backport Bot) [RHEL-170809] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174217] {CVE-2026-43190} - netfilter: ctnetlink: ensure safe access to master conntrack (CKI Backport Bot) [RHEL-173872] {CVE-2026-43116} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173857] {CVE-2026-43110} - redhat/configs: enable CONFIG_AQTION on all archs (CKI Backport Bot) [RHEL-171944] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172745] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172625] {CVE-2026-43027} - io_uring/rsrc: reject zero-length fixed buffer import (CKI Backport Bot) [RHEL-172556] {CVE-2026-43006} - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164434] - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-171637] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-171637] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171159] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171142] {CVE-2026-31684} - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150180] - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-169786] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-169786] - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166991] {CVE-2026-23455} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169738] {CVE-2025-68183} - can: j1939: j1939_session_new(): fix skb reference counting (CKI Backport Bot) [RHEL-162260] {CVE-2024-56645} - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160469] {CVE-2026-23392} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172603] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172577] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-133872] - Recreate RHEL 6.12.0-211.18.1 from CentOS Stream 10 and upstream stable backports (1162-1244) - RHEL changelog for 211.17.1..211.18.1 follows: - Bluetooth: hci_sync: Fix UAF in le_read_features_complete (David Marlin) [RHEL-176903] {CVE-2026-43322} - Bluetooth: hci_sync: fix leaks when hci_cmd_sync_queue_once fails (David Marlin) [RHEL-176903] - Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (David Marlin) [RHEL-176903] - Bluetooth: L2CAP: Add support for setting BT_PHY (David Marlin) [RHEL-176903] - Bluetooth: hci_conn: Fix using conn->le_{tx,rx}_phy as supported PHYs (David Marlin) [RHEL-176903] - Bluetooth: HCI: Add support for LL Extended Feature Set (David Marlin) [RHEL-176903] - Bluetooth: ISO: Add support to bind to trigger PAST (David Marlin) [RHEL-176903] - Bluetooth: HCI: Add initial support for PAST (David Marlin) [RHEL-176903] - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176915] {CVE-2026-43329} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175824] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175824] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175821] - dpll: add pin operational state (Ivan Vecera) [RHEL-175821] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172827] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172827] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172827] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172827] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172827] {CVE-2026-31709} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167837] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167837] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167837] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172930] - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (CKI Backport Bot) [RHEL-171302] - nbd: defer config unlock in nbd_genl_connect (CKI Backport Bot) [RHEL-166953] {CVE-2025-68366} - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163345] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163345] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163345] {CVE-2025-38653} - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178932] {CVE-2026-46243} - redhat/configs: automotive: disable CONFIG_IO_URING (Brian Masney) [RHEL-179469] - sched/deadline: Fix dl_server time accounting (Phil Auld) [RHEL-173950] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171475] {CVE-2026-31613} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157466] - Recreate RHEL 6.12.0-211.20.1 from CentOS Stream 10 and upstream stable backports (1245-1287) - smb cifs.spnego now shipped by RHEL too; existing ahead-fix 1105 is identical (RHEL's redundant copy omitted) - RHEL changelog for 211.19.1..211.20.1 follows: - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473] - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518] - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855] - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419} - scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932] - ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932] - ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932] - ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932] - ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932] - ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932] - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932] - scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932] - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037} - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581} - erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532} - nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788] - Recreate RHEL 6.12.0-211.22.1 from CentOS Stream 10 and upstream stable backports (1288-1352) - RHEL changelog for 211.21.1..211.22.1 follows: - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473] - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518] - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855] - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419} - scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932] - ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932] - ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932] - ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932] - ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932] - ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932] - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932] - scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932] - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037} - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581} - erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532} - nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788] - Recreate RHEL 6.12.0-211.22.1 from CentOS Stream 10 and upstream stable backports (1288-1352) - RHEL changelog for 211.21.1..211.22.1 follows: - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Mircea Dragan) [RHEL-166047] - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183319] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-179723] - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183127] - objtool/klp: Fix unexported static call key access for manually built livepatch modules (Joe Lawrence) [RHEL-178495] - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180307] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180126] {CVE-2026-46125} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180060] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180022] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179358] {CVE-2026-46056} - scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Ewan D. Milne) [RHEL-171774] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175533] {CVE-2026-31474} - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172516] {CVE-2026-31786} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172862] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172492] {CVE-2026-31787} - rxrpc: Fix RxGK token loading to check bounds (CKI Backport Bot) [RHEL-171419] {CVE-2026-31641} - gitlab-ci: use rhel10.2 builder image (Michael Krausch-Hofmann) - redhat/configs: enable watchdog pretimout panic functionality for x86 (David Arcari) [RHEL-182299] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (David Arcari) [RHEL-182299] - mptcp: fix slab-use-after-free in __inet_lookup_established (CKI Backport Bot) [RHEL-171510] {CVE-2026-31669} - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380] {CVE-2026-46331} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173} - crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172772] {CVE-2026-43056} - Recreate RHEL 6.12.0-211.26.1 from CentOS Stream 10 and upstream stable backports (1352-1373) - Enable watchdog pretimeout panic functionality for x86 via kernel config (RHEL-182299) - RHEL changelog for 211.23.1..211.26.1 follows: - nvmet-tcp: fix race between ICReq handling and queue teardown (CKI Backport Bot) [RHEL-180106] {CVE-2026-46135} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180090] {CVE-2026-46145} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172675] {CVE-2026-43038} - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-185117] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174242] {CVE-2026-43198} - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179755] {CVE-2026-43414} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180155] {CVE-2026-46117} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179665] {CVE-2026-45898} - rxrpc: fix RESPONSE authenticator parser OOB read (CKI Backport Bot) [RHEL-171456] {CVE-2026-31636} - Recreate RHEL 6.12.0-211.28.1 from CentOS Stream 10 and upstream stable backports (1375-1383) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1374) - RHEL changelog for 211.27.1..211.28.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759] - crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279} - Recreate RHEL 6.12.0-211.29.1 from CentOS Stream 10 and upstream stable backports (1386-1398) - Retain AlmaLinux ahead-of-RHEL fixes: CVE-2026-46316 (1374), ipv4/ipv6 fraggap (1384-1385) - RHEL changelog for 211.29.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759] - crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279} - Recreate RHEL 6.12.0-211.29.1 from CentOS Stream 10 and upstream stable backports (1386-1398) - Retain AlmaLinux ahead-of-RHEL fixes: CVE-2026-46316 (1374), ipv4/ipv6 fraggap (1384-1385) - RHEL changelog for 211.29.1 follows: - ipv6: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349] - ipv4: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349] - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189491] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182537] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182537] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182537] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182537] - ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions (CKI Backport Bot) [RHEL-185110] - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183965] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181936] {CVE-2026-46244} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179912] {CVE-2026-46209} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998} - rxrpc: Fix potential UAF after skb_unshare() failure (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998} - Recreate RHEL 6.12.0-211.30.1 from CentOS Stream 10 and upstream stable backports (1399-1414) - RHEL 6.12.0-211.30.1 now also carries the vgic-its (CVE-2026-46316) and ipv4/ipv6 fraggap fixes AlmaLinux shipped ahead; the AlmaLinux patches (1374, 1384-1385) are retained and RHEL's duplicate copies omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 211.30.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180776] - eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614} - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180776] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770] - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259} - net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140] - Recreate RHEL 6.12.0-211.31.1 from CentOS Stream 10 and upstream stable backports (1421-1444) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1417) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1418, 1420) - RHEL changelog for 211.31.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Recreate RHEL 6.12.0-211.33.1 from CentOS Stream 10 and upstream stable backports (1451-1455) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1445, 1446) are superseded by RHEL's copies and dropped - RHEL changelog for 211.33.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Recreate RHEL 6.12.0-211.33.1 from CentOS Stream 10 and upstream stable backports (1451-1455) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1445, 1446) are superseded by RHEL's copies and dropped - RHEL changelog for 211.33.1 follows: - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - Recreate RHEL 6.12.0-211.34.1 from CentOS Stream 10 and upstream stable backports (1456-1458) - RHEL changelog for 211.34.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180776] - eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614} - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180776] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770] - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259} - net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140] - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - selftests: kvm: Verify TILELOADD actually #NM faults when XFD[18]=1 (Maxim Levitsky) [RHEL-148618] - selftests: kvm: try getting XFD and XSAVE state out of sync (Maxim Levitsky) [RHEL-148618] - selftests: kvm: replace numbered sync points with actions (Maxim Levitsky) [RHEL-148618] - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Maxim Levitsky) [RHEL-148618] - KVM: selftests: Add ex_str() to print human friendly name of exception vectors (Maxim Levitsky) [RHEL-148618] - KVM: x86: Define AMD's #HV, #VC, and #SX exception vectors (Maxim Levitsky) [RHEL-148618] - KVM: x86: Define Control Protection Exception (#CP) vector (Maxim Levitsky) [RHEL-148618] - KVM: x86: Add human friendly formatting for #XM, and #VE (Maxim Levitsky) [RHEL-148618] - KVM: selftests: Add support for #DE exception fixup (Maxim Levitsky) [RHEL-148618] - idpf: export RX hardware timestamping information to XDP (Michal Schmidt) [RHEL-136674] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - redhat/configs: enable keyboard GPIO for x86 (Mark Langsdorf) [RHEL-147908] - redhat/configs: enable CONFIG_INPUT_SOC_BUTTON_ARRAY on x86 (Mark Langsdorf) [RHEL-135367] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-145800] - selftests/bpf: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - bpf: crypto: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - PCI: vmd: Override irq_startup()/irq_shutdown() in vmd_init_dev_msi_info() (Myron Stowe) [RHEL-143521] - PCI: vmd: Add VMD Device ID Support for Panther Lake (PTL)-H/P/U (Myron Stowe) [RHEL-143521] - net: vlan: don't propagate flags on open (Hangbin Liu) [RHEL-149691] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - redhat/configs: enable keyboard GPIO for x86 (Mark Langsdorf) [RHEL-147908] - redhat/configs: enable CONFIG_INPUT_SOC_BUTTON_ARRAY on x86 (Mark Langsdorf) [RHEL-135367] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-145800] - selftests/bpf: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - bpf: crypto: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - PCI: vmd: Override irq_startup()/irq_shutdown() in vmd_init_dev_msi_info() (Myron Stowe) [RHEL-143521] - PCI: vmd: Add VMD Device ID Support for Panther Lake (PTL)-H/P/U (Myron Stowe) [RHEL-143521] - net: vlan: don't propagate flags on open (Hangbin Liu) [RHEL-149691] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment() and tcp_clone_payload(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - ice: drop udp_tunnel_get_rx_info() call from ndo_open() (Mohammad Heib) [RHEL-165081] - i40e: drop udp_tunnel_get_rx_info() call from i40e_open() (Mohammad Heib) [RHEL-165081] - ALSA: hda/tas2781: Ignore reset check for SPI device (Jaroslav Kysela) [RHEL-157285] - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158990] - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159227] {CVE-2025-68741} - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Vinay Mulugund) [RHEL-155205] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-158206] - net: openvswitch: Avoid releasing netdev before teardown completes (Toke Høiland-Jørgensen) [RHEL-157946] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155971] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150456] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150456] {CVE-2025-39766} - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157855] - ASoC: soc_sdw_utils: remove index from sdca codec name (Jaroslav Kysela) [RHEL-163717] - ASoC: soc_sdw_utils: partial match the codec name (Jaroslav Kysela) [RHEL-163717] - ASoC: add snd_soc_lookup_component_by_name helper (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Update counting of SU/GE DAPM routes (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Handle CONFIG_PM_SLEEP not being set (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Tidy up some memory allocations (Jaroslav Kysela) [RHEL-163717] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157332] {CVE-2026-23270} - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-168569] {CVE-2026-31402} - KVM: x86/mmu: Only WARN in direct MMUs when overwriting shadow-present SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401} - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401} - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-169354] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-169354] - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166932] {CVE-2025-68724} - net: af_can: do not leave a dangling sk pointer in can_create() (CKI Backport Bot) [RHEL-162253] {CVE-2024-56603} - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171531] - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CKI Backport Bot) [RHEL-170974] {CVE-2026-31408} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172213] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172213] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172213] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172213] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172213] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172213] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172213] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172213] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172213] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172213] - xfrm: esp: avoid in-place decrypt on shared skb frags (CKI Backport Bot) [RHEL-174546] {CVE-2026-43284} - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176449] {CVE-2026-46333} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174029] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171434] {CVE-2026-31607} - Recreate RHEL 6.12.0-211.16.1 from CentOS Stream 10 and upstream stable backports (1106-1161) - Drop 211.7.x security-ahead patches superseded by the RHEL backports (1100-1104: crypto authencesn/algif, xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace) - Keep the smb cifs.spnego ahead-fix (1105) - RHEL changelog for 211.8.1..211.16.1 follows: - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169625] - redhat/kernel.spec.template: disable OBJTOOL_WERROR for gcov builds (Oleksii Baranov) - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174756] {CVE-2026-43303} - dpaa2-switch: validate num_ifs to prevent out-of-bounds write (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205} - dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205} - mm: thp: deny THP for files on anonymous inodes (Rafael Aquini) [RHEL-171617] {CVE-2026-23375} - fs: add S_ANON_INODE (Rafael Aquini) [RHEL-171617] - anon_inode: raise SB_I_NODEV and SB_I_NOEXEC (Rafael Aquini) [RHEL-171617] - pidfs: use anon_inode_setattr() (Rafael Aquini) [RHEL-171617] - anon_inode: explicitly block ->setattr() (Rafael Aquini) [RHEL-171617] - pidfs: use anon_inode_getattr() (Rafael Aquini) [RHEL-171617] - anon_inode: use a proper mode internally (Rafael Aquini) [RHEL-171617] - ice: set max queues in alloc_etherdev_mqs() (CKI Backport Bot) [RHEL-174331] - ice: use netif_get_num_default_rss_queues() (CKI Backport Bot) [RHEL-174331] - net: Fix rcu_tasks stall in threaded busypoll (CKI Backport Bot) [RHEL-170809] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174217] {CVE-2026-43190} - netfilter: ctnetlink: ensure safe access to master conntrack (CKI Backport Bot) [RHEL-173872] {CVE-2026-43116} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173857] {CVE-2026-43110} - redhat/configs: enable CONFIG_AQTION on all archs (CKI Backport Bot) [RHEL-171944] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172745] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172625] {CVE-2026-43027} - io_uring/rsrc: reject zero-length fixed buffer import (CKI Backport Bot) [RHEL-172556] {CVE-2026-43006} - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164434] - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-171637] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-171637] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171159] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171142] {CVE-2026-31684} - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150180] - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-169786] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-169786] - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166991] {CVE-2026-23455} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169738] {CVE-2025-68183} - can: j1939: j1939_session_new(): fix skb reference counting (CKI Backport Bot) [RHEL-162260] {CVE-2024-56645} - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160469] {CVE-2026-23392} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172603] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172577] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-133872] - Recreate RHEL 6.12.0-211.18.1 from CentOS Stream 10 and upstream stable backports (1162-1244) - RHEL changelog for 211.17.1..211.18.1 follows: - Bluetooth: hci_sync: Fix UAF in le_read_features_complete (David Marlin) [RHEL-176903] {CVE-2026-43322} - Bluetooth: hci_sync: fix leaks when hci_cmd_sync_queue_once fails (David Marlin) [RHEL-176903] - Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (David Marlin) [RHEL-176903] - Bluetooth: L2CAP: Add support for setting BT_PHY (David Marlin) [RHEL-176903] - Bluetooth: hci_conn: Fix using conn->le_{tx,rx}_phy as supported PHYs (David Marlin) [RHEL-176903] - Bluetooth: HCI: Add support for LL Extended Feature Set (David Marlin) [RHEL-176903] - Bluetooth: ISO: Add support to bind to trigger PAST (David Marlin) [RHEL-176903] - Bluetooth: HCI: Add initial support for PAST (David Marlin) [RHEL-176903] - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176915] {CVE-2026-43329} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175824] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175824] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175821] - dpll: add pin operational state (Ivan Vecera) [RHEL-175821] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172827] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172827] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172827] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172827] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172827] {CVE-2026-31709} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167837] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167837] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167837] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172930] - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (CKI Backport Bot) [RHEL-171302] - nbd: defer config unlock in nbd_genl_connect (CKI Backport Bot) [RHEL-166953] {CVE-2025-68366} - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163345] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163345] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163345] {CVE-2025-38653} - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178932] {CVE-2026-46243} - redhat/configs: automotive: disable CONFIG_IO_URING (Brian Masney) [RHEL-179469] - sched/deadline: Fix dl_server time accounting (Phil Auld) [RHEL-173950] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171475] {CVE-2026-31613} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157466] - Recreate RHEL 6.12.0-211.20.1 from CentOS Stream 10 and upstream stable backports (1245-1287) - smb cifs.spnego now shipped by RHEL too; existing ahead-fix 1105 is identical (RHEL's redundant copy omitted) - RHEL changelog for 211.19.1..211.20.1 follows: - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473] - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518] - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855] - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419} - scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932] - ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932] - ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932] - ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932] - ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932] - ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932] - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932] - scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932] - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037} - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581} - erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532} - nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788] - Recreate RHEL 6.12.0-211.22.1 from CentOS Stream 10 and upstream stable backports (1288-1352) - RHEL changelog for 211.21.1..211.22.1 follows: - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473] - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518] - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855] - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419} - scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932] - ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932] - ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932] - ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932] - ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932] - ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932] - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932] - scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932] - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037} - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581} - erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532} - nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788] - Recreate RHEL 6.12.0-211.22.1 from CentOS Stream 10 and upstream stable backports (1288-1352) - RHEL changelog for 211.21.1..211.22.1 follows: - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Mircea Dragan) [RHEL-166047] - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183319] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-179723] - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183127] - objtool/klp: Fix unexported static call key access for manually built livepatch modules (Joe Lawrence) [RHEL-178495] - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180307] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180126] {CVE-2026-46125} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180060] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180022] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179358] {CVE-2026-46056} - scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Ewan D. Milne) [RHEL-171774] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175533] {CVE-2026-31474} - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172516] {CVE-2026-31786} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172862] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172492] {CVE-2026-31787} - rxrpc: Fix RxGK token loading to check bounds (CKI Backport Bot) [RHEL-171419] {CVE-2026-31641} - gitlab-ci: use rhel10.2 builder image (Michael Krausch-Hofmann) - redhat/configs: enable watchdog pretimout panic functionality for x86 (David Arcari) [RHEL-182299] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (David Arcari) [RHEL-182299] - mptcp: fix slab-use-after-free in __inet_lookup_established (CKI Backport Bot) [RHEL-171510] {CVE-2026-31669} - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380] {CVE-2026-46331} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173} - crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172772] {CVE-2026-43056} - Recreate RHEL 6.12.0-211.26.1 from CentOS Stream 10 and upstream stable backports (1352-1373) - Enable watchdog pretimeout panic functionality for x86 via kernel config (RHEL-182299) - RHEL changelog for 211.23.1..211.26.1 follows: - nvmet-tcp: fix race between ICReq handling and queue teardown (CKI Backport Bot) [RHEL-180106] {CVE-2026-46135} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180090] {CVE-2026-46145} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172675] {CVE-2026-43038} - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-185117] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174242] {CVE-2026-43198} - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179755] {CVE-2026-43414} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180155] {CVE-2026-46117} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179665] {CVE-2026-45898} - rxrpc: fix RESPONSE authenticator parser OOB read (CKI Backport Bot) [RHEL-171456] {CVE-2026-31636} - Recreate RHEL 6.12.0-211.28.1 from CentOS Stream 10 and upstream stable backports (1375-1383) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1374) - RHEL changelog for 211.27.1..211.28.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759] - crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279} - Recreate RHEL 6.12.0-211.29.1 from CentOS Stream 10 and upstream stable backports (1386-1398) - Retain AlmaLinux ahead-of-RHEL fixes: CVE-2026-46316 (1374), ipv4/ipv6 fraggap (1384-1385) - RHEL changelog for 211.29.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759] - crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279} - Recreate RHEL 6.12.0-211.29.1 from CentOS Stream 10 and upstream stable backports (1386-1398) - Retain AlmaLinux ahead-of-RHEL fixes: CVE-2026-46316 (1374), ipv4/ipv6 fraggap (1384-1385) - RHEL changelog for 211.29.1 follows: - ipv6: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349] - ipv4: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349] - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189491] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182537] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182537] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182537] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182537] - ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions (CKI Backport Bot) [RHEL-185110] - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183965] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181936] {CVE-2026-46244} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179912] {CVE-2026-46209} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998} - rxrpc: Fix potential UAF after skb_unshare() failure (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998} - Recreate RHEL 6.12.0-211.30.1 from CentOS Stream 10 and upstream stable backports (1399-1414) - RHEL 6.12.0-211.30.1 now also carries the vgic-its (CVE-2026-46316) and ipv4/ipv6 fraggap fixes AlmaLinux shipped ahead; the AlmaLinux patches (1374, 1384-1385) are retained and RHEL's duplicate copies omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 211.30.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180776] - eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614} - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180776] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770] - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259} - net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140] - Recreate RHEL 6.12.0-211.31.1 from CentOS Stream 10 and upstream stable backports (1421-1444) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1417) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1418, 1420) - RHEL changelog for 211.31.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Recreate RHEL 6.12.0-211.33.1 from CentOS Stream 10 and upstream stable backports (1451-1455) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1445, 1446) are superseded by RHEL's copies and dropped - RHEL changelog for 211.33.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Recreate RHEL 6.12.0-211.33.1 from CentOS Stream 10 and upstream stable backports (1451-1455) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1445, 1446) are superseded by RHEL's copies and dropped - RHEL changelog for 211.33.1 follows: - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - Recreate RHEL 6.12.0-211.34.1 from CentOS Stream 10 and upstream stable backports (1456-1458) - RHEL changelog for 211.34.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180776] - eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614} - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180776] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770] - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259} - net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140] - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - selftests: kvm: Verify TILELOADD actually #NM faults when XFD[18]=1 (Maxim Levitsky) [RHEL-148618] - selftests: kvm: try getting XFD and XSAVE state out of sync (Maxim Levitsky) [RHEL-148618] - selftests: kvm: replace numbered sync points with actions (Maxim Levitsky) [RHEL-148618] - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Maxim Levitsky) [RHEL-148618] - KVM: selftests: Add ex_str() to print human friendly name of exception vectors (Maxim Levitsky) [RHEL-148618] - KVM: x86: Define AMD's #HV, #VC, and #SX exception vectors (Maxim Levitsky) [RHEL-148618] - KVM: x86: Define Control Protection Exception (#CP) vector (Maxim Levitsky) [RHEL-148618] - KVM: x86: Add human friendly formatting for #XM, and #VE (Maxim Levitsky) [RHEL-148618] - KVM: selftests: Add support for #DE exception fixup (Maxim Levitsky) [RHEL-148618] - idpf: export RX hardware timestamping information to XDP (Michal Schmidt) [RHEL-136674] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - redhat/configs: enable keyboard GPIO for x86 (Mark Langsdorf) [RHEL-147908] - redhat/configs: enable CONFIG_INPUT_SOC_BUTTON_ARRAY on x86 (Mark Langsdorf) [RHEL-135367] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-145800] - selftests/bpf: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - bpf: crypto: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - PCI: vmd: Override irq_startup()/irq_shutdown() in vmd_init_dev_msi_info() (Myron Stowe) [RHEL-143521] - PCI: vmd: Add VMD Device ID Support for Panther Lake (PTL)-H/P/U (Myron Stowe) [RHEL-143521] - net: vlan: don't propagate flags on open (Hangbin Liu) [RHEL-149691] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - redhat/configs: enable keyboard GPIO for x86 (Mark Langsdorf) [RHEL-147908] - redhat/configs: enable CONFIG_INPUT_SOC_BUTTON_ARRAY on x86 (Mark Langsdorf) [RHEL-135367] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-145800] - selftests/bpf: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - bpf: crypto: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - PCI: vmd: Override irq_startup()/irq_shutdown() in vmd_init_dev_msi_info() (Myron Stowe) [RHEL-143521] - PCI: vmd: Add VMD Device ID Support for Panther Lake (PTL)-H/P/U (Myron Stowe) [RHEL-143521] - net: vlan: don't propagate flags on open (Hangbin Liu) [RHEL-149691] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Enable Btrfs support for all kernel variants - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment() and tcp_clone_payload(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - Makefile cleanups and added .gitignore - remove Red Hat Makefile targets and specfile - ensure all files have valid SPDX license identifiers - version bump - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Add gating.yaml - Add tests dir Resolves: RHEL-30448 - change gating.yaml target from rhel-9 to rhel-10 Resolves: RHEL-40030 - Bump release for June 2024 mass rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Add an rpminspect.yaml file to turn-off debuginfo testing Resolves: RHEL-70580 - Bump release for RHEL-10 Resolves: RHEL-40030 - add rpminspect.yaml to turn of debuginfo check - add compile options for passing annocheck - Bump the release number and rebuild with the correct JIRA Resolves: RHEL-70587 - Add patch to put stress-ng options in their own manpage section - Change constant name earlystop TO EARLYSTOP - Update the kcompile kernel to linux-6.12-rc4 Resolves: RHEL-63611 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Rebase to upstream rteval-3.9 Resolves: RHEL-65483 - Fix missing system statistics Resolves: RHEL-70167 - Make the default interval for timerlat in rteval 1100us - Make cyclictest the default measurement module for rteval Resolves: RHEL-78395 - rteval: services.py: Fix SyntaxWarning Resolves: RHEL-92783 - Make timerlat the default measurement module - Make the default interval 100us Resolves: RHEL-97541 - Convert spec file to use pyproject.toml build system - Add 8 patches from upstream (spelling fixes, typo corrections, cleanups) - Modernize packaging with %pyproject_wheel and %pyproject_install macros Resolves: RHEL-114900 - Update to rteval-3.10 - set rtla timerlat dma latency to 0 to be more consistent with cyclictest - Create a commandline switch for rteval to use cyclictest - Update rteval-loads requirement to >= 6.17.7-1 Resolves: RHEL-82915, RHEL-116596, RHEL-114927 - Remove rteval -s as a gating test Resolves: RHEL-131402 - Add gating.yaml - Add tests Resolves: RHEL-30432 - Change the gating.yaml from rhel-9 to rhel-10 Resolves: RHEL-42982 - Bump release for June 2024 mass rebuild - Remove code using deprectated engine.h until a better solution available Resolves: RHEL-47107 - Create a kernel based off of linux-6.10.5 and three upstream patches to remove a dependency on deprecated <openssl/engine.h> Resolves: RHEL-47107 - Update to linux-6.12-rc4 which contains the patches to remove dependency on deprecated <openssl/engine.h> Resolves: RHEL-63613 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Changed the kernel version to 6.17.7 - changed the rteval-loads number scheme to reflect the kernel version Resolves: RHEL-86702 - Rebuild in a side-tag to sync with rteval Resolves: RHEL-86702 - Fix run_tests.sh to test linux-6.17.7.tar.xz is installed as a compile load Resolves: RHEL-131349 - Fixed privileged execution of arbitrary scripts by active local user, (CVE-2024-52336) Resolves: RHEL-66636 - Added sanity checks for API methods parameters, (CVE-2024-52337) Resolves: RHEL-66613 - new release - tuned-ppd: removed the use of StrEnum - tuned-ppd: fixed traceback resolves: RHEL-74384 - tuned-ppd: multiple fixes and updates - docs: plugins docs are now automatically generated from the docstrings - plugin_cpu: fixed no_turbo boolean option parsing - plugin_cpu: allowed raw energy_performance_preference values - plugin_vm: added support for dirty_(bytes|ratio) sysctl parameters - plugin_bootloader: added variables to BLS entries only if grub is used - plugin_scheduler: do not assume that perf events have type attribute - plugin_scheduler: updated sched knobs for kernels 6.6+ - plugin_scheduler: log process info when its affinity cannot be changed resolves: RHEL-69933 - plugin_scheduler: postpone cgroup blacklist check, double-check after fail - plugin_scheduler: made perf support optional - plugin_net: added support for hotplug and rename - makefile: added support for installation to custom $BINDIR/$SBINDIR - functions: dropped cpuspeed support - new release - rebased tuned to latest upstream related: RHEL-70454 - sap-hana: Set transparent_hugepages to madvise resolves: RHEL-68454 - plugin_bootloader: export Grub variables to make them available in submenus - utils.commands: fixed CPU online detection when not present - plugin_net: handled cqe-mode-rx ethtool option - profiles: correct CPU governor settings - new release - rebased tuned to latest upstream related: RHEL-70454 - plugins: added missing instance parameters - disk: added missing remove parameter - plugin_scheduler: added switch to disable processing of kthreads - Makefile: added support for installation to custom LIBEXECDIR - functions: create a new parser object for each string expansion - Fix handling of kernel arguments on bootc systems resolves: RHEL-94185 - new release - rebased tuned to latest upstream resolves: RHEL-94809 - tuned-ppd: renamed thinkpad_function_keys as sysfs_acpi_monitor - tuned-ppd: enabled sysfs_acpi_monitor by default - tuned-ppd: fixed inotify watch for performance degradation - tuned-ppd: pinned virtual files in memory for inotify - fixed instance priority inheritance resolves: RHEL-94842 - hotplug: added fixes for device remove race condition - tuned-main.conf: added startup_udev_settle_wait option resolves: RHEL-88238 - functions: silenced errors if module kvm_intel does not exist - functions: make calc_isolated_cores return CPU ranges - scsi: used 'med_power_with_dipm' for SATA ALPM - scsi: do not set ALPM on external SATA ports resolves: RHEL-79913 - network_latency: Set non-zero rcutree.nohz_full_patience_delay - realtime: disable appropriate P-State drivers - plugin_disk: added support for MMC (MultiMediaCard) devices - udev: fix possible traceback in device matcher resolves: RHEL-97087 - udev-settle: obey udev buffer size and handle possible tracebacks resolves: RHEL-92637 - daemon: re-raise daemon init exception in no-daemon mode - vm: deprecate dirty_ratio in favour of dirty_bytes with percents - gui: fix the profile deleter script - new release - rebased tuned to latest upstream related: RHEL-94809 - cpu-partitioning: added initrd generation dracut/systemd workarounds resolves: RHEL-120175 - new release - rebased tuned to latest upstream resolves: RHEL-123608 - cpu-partitioning: autodetect dracut hook directory, systemd workaround resolves: RHEL-40619 - openshift: optimize TCP settings for high throughput and low latency - profiles: Set boost=1 in *-performance profiles - sap-hana: force latency to 70 us, not to C-states resolves: RHEL-142285 - man: fixed instance_acquire_devices example in tuned-adm man resolves: RHEL-90575 - spec: use correct python interpreter for documentation installation - sysctl: add reapply_sysctl_exclude option - ppd: ask tuned recommend for base profile - new release - rebased tuned to latest upstream related: RHEL-123608 - new release - tuned-ppd: removed the use of StrEnum - tuned-ppd: fixed traceback resolves: RHEL-74384 - tuned-ppd: multiple fixes and updates - docs: plugins docs are now automatically generated from the docstrings - plugin_cpu: fixed no_turbo boolean option parsing - plugin_cpu: allowed raw energy_performance_preference values - plugin_vm: added support for dirty_(bytes|ratio) sysctl parameters - plugin_bootloader: added variables to BLS entries only if grub is used - plugin_scheduler: do not assume that perf events have type attribute - plugin_scheduler: updated sched knobs for kernels 6.6+ - plugin_scheduler: log process info when its affinity cannot be changed resolves: RHEL-69933 - plugin_scheduler: postpone cgroup blacklist check, double-check after fail - plugin_scheduler: made perf support optional - plugin_net: added support for hotplug and rename - makefile: added support for installation to custom $BINDIR/$SBINDIR - functions: dropped cpuspeed support - new release - rebased tuned to latest upstream related: RHEL-70454 - sap-hana: Set transparent_hugepages to madvise resolves: RHEL-68454 - plugin_bootloader: export Grub variables to make them available in submenus - utils.commands: fixed CPU online detection when not present - plugin_net: handled cqe-mode-rx ethtool option - profiles: correct CPU governor settings - new release - rebased tuned to latest upstream related: RHEL-70454 - plugins: added missing instance parameters - disk: added missing remove parameter - plugin_scheduler: added switch to disable processing of kthreads - Makefile: added support for installation to custom LIBEXECDIR - functions: create a new parser object for each string expansion - Fix handling of kernel arguments on bootc systems resolves: RHEL-94185 - new release - rebased tuned to latest upstream resolves: RHEL-94809 - tuned-ppd: renamed thinkpad_function_keys as sysfs_acpi_monitor - tuned-ppd: enabled sysfs_acpi_monitor by default - tuned-ppd: fixed inotify watch for performance degradation - tuned-ppd: pinned virtual files in memory for inotify - fixed instance priority inheritance resolves: RHEL-94842 - hotplug: added fixes for device remove race condition - tuned-main.conf: added startup_udev_settle_wait option resolves: RHEL-88238 - functions: silenced errors if module kvm_intel does not exist - functions: make calc_isolated_cores return CPU ranges - scsi: used 'med_power_with_dipm' for SATA ALPM - scsi: do not set ALPM on external SATA ports resolves: RHEL-79913 - network_latency: Set non-zero rcutree.nohz_full_patience_delay - realtime: disable appropriate P-State drivers - plugin_disk: added support for MMC (MultiMediaCard) devices - udev: fix possible traceback in device matcher resolves: RHEL-97087 - udev-settle: obey udev buffer size and handle possible tracebacks resolves: RHEL-92637 - daemon: re-raise daemon init exception in no-daemon mode - vm: deprecate dirty_ratio in favour of dirty_bytes with percents - gui: fix the profile deleter script - new release - rebased tuned to latest upstream related: RHEL-94809 - cpu-partitioning: added initrd generation dracut/systemd workarounds resolves: RHEL-120175 - new release - rebased tuned to latest upstream resolves: RHEL-123608 - cpu-partitioning: autodetect dracut hook directory, systemd workaround resolves: RHEL-40619 - openshift: optimize TCP settings for high throughput and low latency - profiles: Set boost=1 in *-performance profiles - sap-hana: force latency to 70 us, not to C-states resolves: RHEL-142285 - man: fixed instance_acquire_devices example in tuned-adm man resolves: RHEL-90575 - spec: use correct python interpreter for documentation installation - sysctl: add reapply_sysctl_exclude option - ppd: ask tuned recommend for base profile - new release - rebased tuned to latest upstream related: RHEL-123608 - net: added more coalescing options, filter out unsupported ones resolves: RHEL-181667 - Fixed privileged execution of arbitrary scripts by active local user, (CVE-2024-52336) Resolves: RHEL-66636 - Added sanity checks for API methods parameters, (CVE-2024-52337) Resolves: RHEL-66613 - new release - tuned-ppd: removed the use of StrEnum - tuned-ppd: fixed traceback resolves: RHEL-74384 - tuned-ppd: multiple fixes and updates - docs: plugins docs are now automatically generated from the docstrings - plugin_cpu: fixed no_turbo boolean option parsing - plugin_cpu: allowed raw energy_performance_preference values - plugin_vm: added support for dirty_(bytes|ratio) sysctl parameters - plugin_bootloader: added variables to BLS entries only if grub is used - plugin_scheduler: do not assume that perf events have type attribute - plugin_scheduler: updated sched knobs for kernels 6.6+ - plugin_scheduler: log process info when its affinity cannot be changed resolves: RHEL-69933 - plugin_scheduler: postpone cgroup blacklist check, double-check after fail - plugin_scheduler: made perf support optional - plugin_net: added support for hotplug and rename - makefile: added support for installation to custom $BINDIR/$SBINDIR - functions: dropped cpuspeed support - new release - rebased tuned to latest upstream related: RHEL-70454 - sap-hana: Set transparent_hugepages to madvise resolves: RHEL-68454 - plugin_bootloader: export Grub variables to make them available in submenus - utils.commands: fixed CPU online detection when not present - plugin_net: handled cqe-mode-rx ethtool option - profiles: correct CPU governor settings - new release - rebased tuned to latest upstream related: RHEL-70454 - plugins: added missing instance parameters - disk: added missing remove parameter - plugin_scheduler: added switch to disable processing of kthreads - Makefile: added support for installation to custom LIBEXECDIR - functions: create a new parser object for each string expansion - Fix handling of kernel arguments on bootc systems resolves: RHEL-94185 - new release - rebased tuned to latest upstream resolves: RHEL-94809 - tuned-ppd: renamed thinkpad_function_keys as sysfs_acpi_monitor - tuned-ppd: enabled sysfs_acpi_monitor by default - tuned-ppd: fixed inotify watch for performance degradation - tuned-ppd: pinned virtual files in memory for inotify - fixed instance priority inheritance resolves: RHEL-94842 - hotplug: added fixes for device remove race condition - tuned-main.conf: added startup_udev_settle_wait option resolves: RHEL-88238 - functions: silenced errors if module kvm_intel does not exist - functions: make calc_isolated_cores return CPU ranges - scsi: used 'med_power_with_dipm' for SATA ALPM - scsi: do not set ALPM on external SATA ports resolves: RHEL-79913 - network_latency: Set non-zero rcutree.nohz_full_patience_delay - realtime: disable appropriate P-State drivers - plugin_disk: added support for MMC (MultiMediaCard) devices - udev: fix possible traceback in device matcher resolves: RHEL-97087 - udev-settle: obey udev buffer size and handle possible tracebacks resolves: RHEL-92637 - daemon: re-raise daemon init exception in no-daemon mode - vm: deprecate dirty_ratio in favour of dirty_bytes with percents - gui: fix the profile deleter script - new release - rebased tuned to latest upstream related: RHEL-94809 - cpu-partitioning: added initrd generation dracut/systemd workarounds resolves: RHEL-120175 - new release - rebased tuned to latest upstream resolves: RHEL-123608 - cpu-partitioning: autodetect dracut hook directory, systemd workaround resolves: RHEL-40619 - openshift: optimize TCP settings for high throughput and low latency - profiles: Set boost=1 in *-performance profiles - sap-hana: force latency to 70 us, not to C-states resolves: RHEL-142285 - man: fixed instance_acquire_devices example in tuned-adm man resolves: RHEL-90575 - spec: use correct python interpreter for documentation installation - sysctl: add reapply_sysctl_exclude option - ppd: ask tuned recommend for base profile - new release - rebased tuned to latest upstream related: RHEL-123608 - new release - tuned-ppd: removed the use of StrEnum - tuned-ppd: fixed traceback resolves: RHEL-74384 - tuned-ppd: multiple fixes and updates - docs: plugins docs are now automatically generated from the docstrings - plugin_cpu: fixed no_turbo boolean option parsing - plugin_cpu: allowed raw energy_performance_preference values - plugin_vm: added support for dirty_(bytes|ratio) sysctl parameters - plugin_bootloader: added variables to BLS entries only if grub is used - plugin_scheduler: do not assume that perf events have type attribute - plugin_scheduler: updated sched knobs for kernels 6.6+ - plugin_scheduler: log process info when its affinity cannot be changed resolves: RHEL-69933 - plugin_scheduler: postpone cgroup blacklist check, double-check after fail - plugin_scheduler: made perf support optional - plugin_net: added support for hotplug and rename - makefile: added support for installation to custom $BINDIR/$SBINDIR - functions: dropped cpuspeed support - new release - rebased tuned to latest upstream related: RHEL-70454 - sap-hana: Set transparent_hugepages to madvise resolves: RHEL-68454 - plugin_bootloader: export Grub variables to make them available in submenus - utils.commands: fixed CPU online detection when not present - plugin_net: handled cqe-mode-rx ethtool option - profiles: correct CPU governor settings - new release - rebased tuned to latest upstream related: RHEL-70454 - plugins: added missing instance parameters - disk: added missing remove parameter - plugin_scheduler: added switch to disable processing of kthreads - Makefile: added support for installation to custom LIBEXECDIR - functions: create a new parser object for each string expansion - Fix handling of kernel arguments on bootc systems resolves: RHEL-94185 - new release - rebased tuned to latest upstream resolves: RHEL-94809 - tuned-ppd: renamed thinkpad_function_keys as sysfs_acpi_monitor - tuned-ppd: enabled sysfs_acpi_monitor by default - tuned-ppd: fixed inotify watch for performance degradation - tuned-ppd: pinned virtual files in memory for inotify - fixed instance priority inheritance resolves: RHEL-94842 - hotplug: added fixes for device remove race condition - tuned-main.conf: added startup_udev_settle_wait option resolves: RHEL-88238 - functions: silenced errors if module kvm_intel does not exist - functions: make calc_isolated_cores return CPU ranges - scsi: used 'med_power_with_dipm' for SATA ALPM - scsi: do not set ALPM on external SATA ports resolves: RHEL-79913 - network_latency: Set non-zero rcutree.nohz_full_patience_delay - realtime: disable appropriate P-State drivers - plugin_disk: added support for MMC (MultiMediaCard) devices - udev: fix possible traceback in device matcher resolves: RHEL-97087 - udev-settle: obey udev buffer size and handle possible tracebacks resolves: RHEL-92637 - daemon: re-raise daemon init exception in no-daemon mode - vm: deprecate dirty_ratio in favour of dirty_bytes with percents - gui: fix the profile deleter script - new release - rebased tuned to latest upstream related: RHEL-94809 - cpu-partitioning: added initrd generation dracut/systemd workarounds resolves: RHEL-120175 - new release - rebased tuned to latest upstream resolves: RHEL-123608 - cpu-partitioning: autodetect dracut hook directory, systemd workaround resolves: RHEL-40619 - openshift: optimize TCP settings for high throughput and low latency - profiles: Set boost=1 in *-performance profiles - sap-hana: force latency to 70 us, not to C-states resolves: RHEL-142285 - man: fixed instance_acquire_devices example in tuned-adm man resolves: RHEL-90575 - spec: use correct python interpreter for documentation installation - sysctl: add reapply_sysctl_exclude option - ppd: ask tuned recommend for base profile - new release - rebased tuned to latest upstream related: RHEL-123608 - net: added more coalescing options, filter out unsupported ones resolves: RHEL-181667 - Fixed privileged execution of arbitrary scripts by active local user, (CVE-2024-52336) Resolves: RHEL-66636 - Added sanity checks for API methods parameters, (CVE-2024-52337) Resolves: RHEL-66613 - new release - tuned-ppd: removed the use of StrEnum - tuned-ppd: fixed traceback resolves: RHEL-74384 - tuned-ppd: multiple fixes and updates - docs: plugins docs are now automatically generated from the docstrings - plugin_cpu: fixed no_turbo boolean option parsing - plugin_cpu: allowed raw energy_performance_preference values - plugin_vm: added support for dirty_(bytes|ratio) sysctl parameters - plugin_bootloader: added variables to BLS entries only if grub is used - plugin_scheduler: do not assume that perf events have type attribute - plugin_scheduler: updated sched knobs for kernels 6.6+ - plugin_scheduler: log process info when its affinity cannot be changed resolves: RHEL-69933 - plugin_scheduler: postpone cgroup blacklist check, double-check after fail - plugin_scheduler: made perf support optional - plugin_net: added support for hotplug and rename - makefile: added support for installation to custom $BINDIR/$SBINDIR - functions: dropped cpuspeed support - new release - rebased tuned to latest upstream related: RHEL-70454 - sap-hana: Set transparent_hugepages to madvise resolves: RHEL-68454 - plugin_bootloader: export Grub variables to make them available in submenus - utils.commands: fixed CPU online detection when not present - plugin_net: handled cqe-mode-rx ethtool option - profiles: correct CPU governor settings - new release - rebased tuned to latest upstream related: RHEL-70454 - plugins: added missing instance parameters - disk: added missing remove parameter - plugin_scheduler: added switch to disable processing of kthreads - Makefile: added support for installation to custom LIBEXECDIR - functions: create a new parser object for each string expansion - Fix handling of kernel arguments on bootc systems resolves: RHEL-94185 - new release - rebased tuned to latest upstream resolves: RHEL-94809 - tuned-ppd: renamed thinkpad_function_keys as sysfs_acpi_monitor - tuned-ppd: enabled sysfs_acpi_monitor by default - tuned-ppd: fixed inotify watch for performance degradation - tuned-ppd: pinned virtual files in memory for inotify - fixed instance priority inheritance resolves: RHEL-94842 - hotplug: added fixes for device remove race condition - tuned-main.conf: added startup_udev_settle_wait option resolves: RHEL-88238 - functions: silenced errors if module kvm_intel does not exist - functions: make calc_isolated_cores return CPU ranges - scsi: used 'med_power_with_dipm' for SATA ALPM - scsi: do not set ALPM on external SATA ports resolves: RHEL-79913 - network_latency: Set non-zero rcutree.nohz_full_patience_delay - realtime: disable appropriate P-State drivers - plugin_disk: added support for MMC (MultiMediaCard) devices - udev: fix possible traceback in device matcher resolves: RHEL-97087 - udev-settle: obey udev buffer size and handle possible tracebacks resolves: RHEL-92637 - daemon: re-raise daemon init exception in no-daemon mode - vm: deprecate dirty_ratio in favour of dirty_bytes with percents - gui: fix the profile deleter script - new release - rebased tuned to latest upstream related: RHEL-94809 - cpu-partitioning: added initrd generation dracut/systemd workarounds resolves: RHEL-120175 - new release - rebased tuned to latest upstream resolves: RHEL-123608 - cpu-partitioning: autodetect dracut hook directory, systemd workaround resolves: RHEL-40619 - openshift: optimize TCP settings for high throughput and low latency - profiles: Set boost=1 in *-performance profiles - sap-hana: force latency to 70 us, not to C-states resolves: RHEL-142285 - man: fixed instance_acquire_devices example in tuned-adm man resolves: RHEL-90575 - spec: use correct python interpreter for documentation installation - sysctl: add reapply_sysctl_exclude option - ppd: ask tuned recommend for base profile - new release - rebased tuned to latest upstream related: RHEL-123608 - new release - tuned-ppd: removed the use of StrEnum - tuned-ppd: fixed traceback resolves: RHEL-74384 - tuned-ppd: multiple fixes and updates - docs: plugins docs are now automatically generated from the docstrings - plugin_cpu: fixed no_turbo boolean option parsing - plugin_cpu: allowed raw energy_performance_preference values - plugin_vm: added support for dirty_(bytes|ratio) sysctl parameters - plugin_bootloader: added variables to BLS entries only if grub is used - plugin_scheduler: do not assume that perf events have type attribute - plugin_scheduler: updated sched knobs for kernels 6.6+ - plugin_scheduler: log process info when its affinity cannot be changed resolves: RHEL-69933 - plugin_scheduler: postpone cgroup blacklist check, double-check after fail - plugin_scheduler: made perf support optional - plugin_net: added support for hotplug and rename - makefile: added support for installation to custom $BINDIR/$SBINDIR - functions: dropped cpuspeed support - new release - rebased tuned to latest upstream related: RHEL-70454 - sap-hana: Set transparent_hugepages to madvise resolves: RHEL-68454 - plugin_bootloader: export Grub variables to make them available in submenus - utils.commands: fixed CPU online detection when not present - plugin_net: handled cqe-mode-rx ethtool option - profiles: correct CPU governor settings - new release - rebased tuned to latest upstream related: RHEL-70454 - plugins: added missing instance parameters - disk: added missing remove parameter - plugin_scheduler: added switch to disable processing of kthreads - Makefile: added support for installation to custom LIBEXECDIR - functions: create a new parser object for each string expansion - Fix handling of kernel arguments on bootc systems resolves: RHEL-94185 - new release - rebased tuned to latest upstream resolves: RHEL-94809 - tuned-ppd: renamed thinkpad_function_keys as sysfs_acpi_monitor - tuned-ppd: enabled sysfs_acpi_monitor by default - tuned-ppd: fixed inotify watch for performance degradation - tuned-ppd: pinned virtual files in memory for inotify - fixed instance priority inheritance resolves: RHEL-94842 - hotplug: added fixes for device remove race condition - tuned-main.conf: added startup_udev_settle_wait option resolves: RHEL-88238 - functions: silenced errors if module kvm_intel does not exist - functions: make calc_isolated_cores return CPU ranges - scsi: used 'med_power_with_dipm' for SATA ALPM - scsi: do not set ALPM on external SATA ports resolves: RHEL-79913 - network_latency: Set non-zero rcutree.nohz_full_patience_delay - realtime: disable appropriate P-State drivers - plugin_disk: added support for MMC (MultiMediaCard) devices - udev: fix possible traceback in device matcher resolves: RHEL-97087 - udev-settle: obey udev buffer size and handle possible tracebacks resolves: RHEL-92637 - daemon: re-raise daemon init exception in no-daemon mode - vm: deprecate dirty_ratio in favour of dirty_bytes with percents - gui: fix the profile deleter script - new release - rebased tuned to latest upstream related: RHEL-94809 - cpu-partitioning: added initrd generation dracut/systemd workarounds resolves: RHEL-120175 - new release - rebased tuned to latest upstream resolves: RHEL-123608 - cpu-partitioning: autodetect dracut hook directory, systemd workaround resolves: RHEL-40619 - openshift: optimize TCP settings for high throughput and low latency - profiles: Set boost=1 in *-performance profiles - sap-hana: force latency to 70 us, not to C-states resolves: RHEL-142285 - man: fixed instance_acquire_devices example in tuned-adm man resolves: RHEL-90575 - spec: use correct python interpreter for documentation installation - sysctl: add reapply_sysctl_exclude option - ppd: ask tuned recommend for base profile - new release - rebased tuned to latest upstream related: RHEL-123608 - net: added more coalescing options, filter out unsupported ones resolves: RHEL-181667 - Fixed privileged execution of arbitrary scripts by active local user, (CVE-2024-52336) Resolves: RHEL-66636 - Added sanity checks for API methods parameters, (CVE-2024-52337) Resolves: RHEL-66613 - new release - tuned-ppd: removed the use of StrEnum - tuned-ppd: fixed traceback resolves: RHEL-74384 - tuned-ppd: multiple fixes and updates - docs: plugins docs are now automatically generated from the docstrings - plugin_cpu: fixed no_turbo boolean option parsing - plugin_cpu: allowed raw energy_performance_preference values - plugin_vm: added support for dirty_(bytes|ratio) sysctl parameters - plugin_bootloader: added variables to BLS entries only if grub is used - plugin_scheduler: do not assume that perf events have type attribute - plugin_scheduler: updated sched knobs for kernels 6.6+ - plugin_scheduler: log process info when its affinity cannot be changed resolves: RHEL-69933 - plugin_scheduler: postpone cgroup blacklist check, double-check after fail - plugin_scheduler: made perf support optional - plugin_net: added support for hotplug and rename - makefile: added support for installation to custom $BINDIR/$SBINDIR - functions: dropped cpuspeed support - new release - rebased tuned to latest upstream related: RHEL-70454 - sap-hana: Set transparent_hugepages to madvise resolves: RHEL-68454 - plugin_bootloader: export Grub variables to make them available in submenus - utils.commands: fixed CPU online detection when not present - plugin_net: handled cqe-mode-rx ethtool option - profiles: correct CPU governor settings - new release - rebased tuned to latest upstream related: RHEL-70454 - plugins: added missing instance parameters - disk: added missing remove parameter - plugin_scheduler: added switch to disable processing of kthreads - Makefile: added support for installation to custom LIBEXECDIR - functions: create a new parser object for each string expansion - Fix handling of kernel arguments on bootc systems resolves: RHEL-94185 - new release - rebased tuned to latest upstream resolves: RHEL-94809 - tuned-ppd: renamed thinkpad_function_keys as sysfs_acpi_monitor - tuned-ppd: enabled sysfs_acpi_monitor by default - tuned-ppd: fixed inotify watch for performance degradation - tuned-ppd: pinned virtual files in memory for inotify - fixed instance priority inheritance resolves: RHEL-94842 - hotplug: added fixes for device remove race condition - tuned-main.conf: added startup_udev_settle_wait option resolves: RHEL-88238 - functions: silenced errors if module kvm_intel does not exist - functions: make calc_isolated_cores return CPU ranges - scsi: used 'med_power_with_dipm' for SATA ALPM - scsi: do not set ALPM on external SATA ports resolves: RHEL-79913 - network_latency: Set non-zero rcutree.nohz_full_patience_delay - realtime: disable appropriate P-State drivers - plugin_disk: added support for MMC (MultiMediaCard) devices - udev: fix possible traceback in device matcher resolves: RHEL-97087 - udev-settle: obey udev buffer size and handle possible tracebacks resolves: RHEL-92637 - daemon: re-raise daemon init exception in no-daemon mode - vm: deprecate dirty_ratio in favour of dirty_bytes with percents - gui: fix the profile deleter script - new release - rebased tuned to latest upstream related: RHEL-94809 - cpu-partitioning: added initrd generation dracut/systemd workarounds resolves: RHEL-120175 - new release - rebased tuned to latest upstream resolves: RHEL-123608 - cpu-partitioning: autodetect dracut hook directory, systemd workaround resolves: RHEL-40619 - openshift: optimize TCP settings for high throughput and low latency - profiles: Set boost=1 in *-performance profiles - sap-hana: force latency to 70 us, not to C-states resolves: RHEL-142285 - man: fixed instance_acquire_devices example in tuned-adm man resolves: RHEL-90575 - spec: use correct python interpreter for documentation installation - sysctl: add reapply_sysctl_exclude option - ppd: ask tuned recommend for base profile - new release - rebased tuned to latest upstream related: RHEL-123608 - new release - tuned-ppd: removed the use of StrEnum - tuned-ppd: fixed traceback resolves: RHEL-74384 - tuned-ppd: multiple fixes and updates - docs: plugins docs are now automatically generated from the docstrings - plugin_cpu: fixed no_turbo boolean option parsing - plugin_cpu: allowed raw energy_performance_preference values - plugin_vm: added support for dirty_(bytes|ratio) sysctl parameters - plugin_bootloader: added variables to BLS entries only if grub is used - plugin_scheduler: do not assume that perf events have type attribute - plugin_scheduler: updated sched knobs for kernels 6.6+ - plugin_scheduler: log process info when its affinity cannot be changed resolves: RHEL-69933 - plugin_scheduler: postpone cgroup blacklist check, double-check after fail - plugin_scheduler: made perf support optional - plugin_net: added support for hotplug and rename - makefile: added support for installation to custom $BINDIR/$SBINDIR - functions: dropped cpuspeed support - new release - rebased tuned to latest upstream related: RHEL-70454 - sap-hana: Set transparent_hugepages to madvise resolves: RHEL-68454 - plugin_bootloader: export Grub variables to make them available in submenus - utils.commands: fixed CPU online detection when not present - plugin_net: handled cqe-mode-rx ethtool option - profiles: correct CPU governor settings - new release - rebased tuned to latest upstream related: RHEL-70454 - plugins: added missing instance parameters - disk: added missing remove parameter - plugin_scheduler: added switch to disable processing of kthreads - Makefile: added support for installation to custom LIBEXECDIR - functions: create a new parser object for each string expansion - Fix handling of kernel arguments on bootc systems resolves: RHEL-94185 - new release - rebased tuned to latest upstream resolves: RHEL-94809 - tuned-ppd: renamed thinkpad_function_keys as sysfs_acpi_monitor - tuned-ppd: enabled sysfs_acpi_monitor by default - tuned-ppd: fixed inotify watch for performance degradation - tuned-ppd: pinned virtual files in memory for inotify - fixed instance priority inheritance resolves: RHEL-94842 - hotplug: added fixes for device remove race condition - tuned-main.conf: added startup_udev_settle_wait option resolves: RHEL-88238 - functions: silenced errors if module kvm_intel does not exist - functions: make calc_isolated_cores return CPU ranges - scsi: used 'med_power_with_dipm' for SATA ALPM - scsi: do not set ALPM on external SATA ports resolves: RHEL-79913 - network_latency: Set non-zero rcutree.nohz_full_patience_delay - realtime: disable appropriate P-State drivers - plugin_disk: added support for MMC (MultiMediaCard) devices - udev: fix possible traceback in device matcher resolves: RHEL-97087 - udev-settle: obey udev buffer size and handle possible tracebacks resolves: RHEL-92637 - daemon: re-raise daemon init exception in no-daemon mode - vm: deprecate dirty_ratio in favour of dirty_bytes with percents - gui: fix the profile deleter script - new release - rebased tuned to latest upstream related: RHEL-94809 - cpu-partitioning: added initrd generation dracut/systemd workarounds resolves: RHEL-120175 - new release - rebased tuned to latest upstream resolves: RHEL-123608 - cpu-partitioning: autodetect dracut hook directory, systemd workaround resolves: RHEL-40619 - openshift: optimize TCP settings for high throughput and low latency - profiles: Set boost=1 in *-performance profiles - sap-hana: force latency to 70 us, not to C-states resolves: RHEL-142285 - man: fixed instance_acquire_devices example in tuned-adm man resolves: RHEL-90575 - spec: use correct python interpreter for documentation installation - sysctl: add reapply_sysctl_exclude option - ppd: ask tuned recommend for base profile - new release - rebased tuned to latest upstream related: RHEL-123608 - net: added more coalescing options, filter out unsupported ones resolves: RHEL-181667